aba5cde3f9b841b032f9efcbc80c4c469e1f345d818c3fa90046ca5b5afb8505

Analysis

max time kernel
29s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2023 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mail_4274476.doc
Size

511.4MB
MD5

b5c5a49a90b1eda58078f1d12a66134a
SHA1

a44a300a79d24db8a0577b41685ff70bf8210596
SHA256

95c525353bdebaa7f105518a7d62a67f14a39dfd9276e0a25c6ad5fbb95ae9ea
SHA512

f9a425b6ea7661e49124e7217d62b151101368657c490f4a301a4af1282e24cde0899c01bca82816b74848bae129541ab1a1fa137f654a7da8da4da876d5ec43
SSDEEP

6144:zZRtBPT4N/uQaNULlPUvauNTklB7ShcbYdFf8UOPv:zZvJhfKd2amwYdKUq

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 9 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	49	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	51	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	41	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	45	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	57	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	47	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	53	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	55	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4072 WINWORD.EXE
4072 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

4072 WINWORD.EXE
4072 WINWORD.EXE
4072 WINWORD.EXE
4072 WINWORD.EXE
4072 WINWORD.EXE
4072 WINWORD.EXE
4072 WINWORD.EXE
4072 WINWORD.EXE

pid	process
4072	WINWORD.EXE
4072	WINWORD.EXE

pid	process
4072	WINWORD.EXE
4072	WINWORD.EXE
4072	WINWORD.EXE
4072	WINWORD.EXE
4072	WINWORD.EXE
4072	WINWORD.EXE
4072	WINWORD.EXE
4072	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Mail_4274476.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-133-0x00007FFADF930000-0x00007FFADF940000-memory.dmp

Filesize
64KB

Download
memory/4072-134-0x00007FFADF930000-0x00007FFADF940000-memory.dmp

Filesize
64KB

Download
memory/4072-135-0x00007FFADF930000-0x00007FFADF940000-memory.dmp

Filesize
64KB

Download
memory/4072-136-0x00007FFADF930000-0x00007FFADF940000-memory.dmp

Filesize
64KB

Download
memory/4072-137-0x00007FFADF930000-0x00007FFADF940000-memory.dmp

Filesize
64KB

Download
memory/4072-138-0x00007FFADD8D0000-0x00007FFADD8E0000-memory.dmp

Filesize
64KB

Download
memory/4072-139-0x00007FFADD8D0000-0x00007FFADD8E0000-memory.dmp

Filesize
64KB

Download