Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
21-03-2023 23:29
General
-
Target
801f13593959bf1d6d1a40eebe49ed579cf5ebc92d6ac6adc7516b5d1e087655.doc
-
Size
267KB
-
MD5
9d637146675b8bac3609bee390834f11
-
SHA1
23118f74c14e3d76c6436168b79b513186cecd8b
-
SHA256
801f13593959bf1d6d1a40eebe49ed579cf5ebc92d6ac6adc7516b5d1e087655
-
SHA512
ebe51f0427ea841ba42aa71d522ef73938db1496dabd80dcd1bf32828fb1ddb0e49a546afb2bfcb50a00e2f741b4f4a5b09ba84b5d49fa3df308b9f013026314
-
SSDEEP
3072:HSw3AZSJc+yRiJlGK13FZgJ37TGVdhCvcwoXjsr5kZcn5lvgNDDghUxvxwxSd:yo48HngAZgN7Tga09T4hn5m/PxvWY
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Script User-Agent 10 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\801f13593959bf1d6d1a40eebe49ed579cf5ebc92d6ac6adc7516b5d1e087655.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB