Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 03:45
Behavioral task
behavioral1
Sample
Exercises on form.doc
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Exercises on form.doc
Resource
win10v2004-20230220-en
General
-
Target
Exercises on form.doc
-
Size
198KB
-
MD5
3055dcadfe483d8002d1999aaf117be3
-
SHA1
205d4f3147259d4ea7ee50c10c9a84e1dbbdafbc
-
SHA256
7624feae9127bb4a6a0e38d911853f96db39f1272a48be72bef322e87f3719b0
-
SHA512
8120670c8c38fabec777e8e6a1dcc69a555a827dec0b80fb786348c7ccf1cc0aab37c4c51a60c23e159efe857628356c7985e1850fc74eb2ac4cc4b86bcc8fa1
-
SSDEEP
3072:UGyX60FBUHqE97pe2yd8SorRYKX117eCL4JH:UbB5MVKdAFYKX1peZ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3844 WINWORD.EXE 3844 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
WINWORD.EXEpid process 3844 WINWORD.EXE 3844 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
WINWORD.EXEpid process 3844 WINWORD.EXE 3844 WINWORD.EXE 3844 WINWORD.EXE 3844 WINWORD.EXE 3844 WINWORD.EXE 3844 WINWORD.EXE 3844 WINWORD.EXE 3844 WINWORD.EXE 3844 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 3844 wrote to memory of 1340 3844 WINWORD.EXE splwow64.exe PID 3844 wrote to memory of 1340 3844 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Exercises on form.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\24834E01.wmfFilesize
370B
MD5c4d9a1f3f1b0eaaac7a45e041234634f
SHA1885ce79c1690342af88f0e0fa04c8c26cc21e8b5
SHA256fc7bf94b0a8e403b7e74ec67a619fe1c1a61700c8509426c382ea5ebfc6f4013
SHA512f39a5be44051940cd5826d4ef87936f514b383cf81a5d4f24288227472dd5bd13ed31ba57ea23a86945d373a59b40f73ac33a9330473c22a38d7c3bcc7af1df6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D5B06F58.wmfFilesize
370B
MD5271d85431b6b680813e35000305ddd89
SHA1b943a11edf9612f9feca7d91985afb473191ebc5
SHA256041186bc3112af22e8608a6db5ffbc11ea061eb66aa095d902bf2e30d482c032
SHA512700308335934104e86fe47c8dbcb0b7d9e1864b1c8acd524505258440bb2d2734696a03447d8f0822e042c3156b6e0b580dfc2f36342f2e5d946a32773268b19
-
memory/3844-133-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmpFilesize
64KB
-
memory/3844-134-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmpFilesize
64KB
-
memory/3844-135-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmpFilesize
64KB
-
memory/3844-136-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmpFilesize
64KB
-
memory/3844-137-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmpFilesize
64KB
-
memory/3844-138-0x00007FF8E8190000-0x00007FF8E81A0000-memory.dmpFilesize
64KB
-
memory/3844-139-0x00007FF8E8190000-0x00007FF8E81A0000-memory.dmpFilesize
64KB
-
memory/3844-304-0x000001384E2B0000-0x000001384E4B0000-memory.dmpFilesize
2.0MB
-
memory/3844-649-0x000001384E2B0000-0x000001384E4B0000-memory.dmpFilesize
2.0MB