0663c87b796c01fc839ab0d169701d13d3feee0556347e09c088fbf43c7f20ea

Resubmissions

30-03-2023 07:38

230330-jgh1fabe73 8

30-03-2023 07:29

230330-jbfccsda5w 8

30-03-2023 07:24

230330-h8gq1sbd89 10

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0663c87b796c01fc839ab0d169701d13d3feee0556347e09c088fbf43c7f20ea.doc
Size

532.3MB
MD5

ac93db48d64557d335d318ce355ea4de
SHA1

fa241a115d1a08ead7bd699a4e7723bb56817db4
SHA256

0663c87b796c01fc839ab0d169701d13d3feee0556347e09c088fbf43c7f20ea
SHA512

6b15215d8a8cf278ca4e9b18ca0a9e7183e880fe38a42175b8f546380a41393009e4dbd8e64ac76b79913534a1e9daaa62d7d4c40482c75adb3373fe5a339658
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

976 3824 WerFault.exe

pid	pid_target	process	target process
976	3824	WerFault.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	31	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	34	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	38	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	40	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	29	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4452 WINWORD.EXE
4452 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

4452 WINWORD.EXE
4452 WINWORD.EXE
4452 WINWORD.EXE
4452 WINWORD.EXE
4452 WINWORD.EXE
4452 WINWORD.EXE
4452 WINWORD.EXE
4452 WINWORD.EXE

pid	process
4452	WINWORD.EXE
4452	WINWORD.EXE

pid	process
4452	WINWORD.EXE
4452	WINWORD.EXE
4452	WINWORD.EXE
4452	WINWORD.EXE
4452	WINWORD.EXE
4452	WINWORD.EXE
4452	WINWORD.EXE
4452	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0663c87b796c01fc839ab0d169701d13d3feee0556347e09c088fbf43c7f20ea.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 3824 -ip 3824
1⤵
PID:3612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3824 -s 772
1⤵
- Program crash
PID:976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4452-133-0x00007FFD61C70000-0x00007FFD61C80000-memory.dmp

Filesize
64KB

Download
memory/4452-135-0x00007FFD61C70000-0x00007FFD61C80000-memory.dmp

Filesize
64KB

Download
memory/4452-134-0x00007FFD61C70000-0x00007FFD61C80000-memory.dmp

Filesize
64KB

Download
memory/4452-136-0x00007FFD61C70000-0x00007FFD61C80000-memory.dmp

Filesize
64KB

Download
memory/4452-137-0x00007FFD61C70000-0x00007FFD61C80000-memory.dmp

Filesize
64KB

Download
memory/4452-138-0x00007FFD5F310000-0x00007FFD5F320000-memory.dmp

Filesize
64KB

Download
memory/4452-139-0x00007FFD5F310000-0x00007FFD5F320000-memory.dmp

Filesize
64KB

Download