Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2023 22:47
Behavioral task
behavioral1
Sample
www.education.ne.gov_wp-content_uploads_2017_07_formativeprincipalschooldistrictadministratorevaluat.docm
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
www.education.ne.gov_wp-content_uploads_2017_07_formativeprincipalschooldistrictadministratorevaluat.docm
Resource
win10v2004-20230220-en
General
-
Target
www.education.ne.gov_wp-content_uploads_2017_07_formativeprincipalschooldistrictadministratorevaluat.docm
-
Size
80KB
-
MD5
f278f58ebc085994a9fc092d76c1d4d8
-
SHA1
60379f8d49b01b4d8f064730c3ff46a3ac47b94a
-
SHA256
aa4e6143eeb31aa97d419d3dda09746249d4a3f4207fac930973d2970a70c5e0
-
SHA512
39b5ee8222038c34ca13735d14df48f7fd47ac315a15cd0338aaee2c208307c5e81d1d7af4168a971902c9f253f62124984d05c014b14a4f67b4f55b7d0b2005
-
SSDEEP
1536:aCMgd+NowwfY9Jv13uQfiMXmkjWrz+8LNEEOOcZSwyc6Y2:hYgov13uCwkjR8P/YSwmJ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3888 WINWORD.EXE 3888 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\www.education.ne.gov_wp-content_uploads_2017_07_formativeprincipalschooldistrictadministratorevaluat.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3888-133-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-134-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-135-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-136-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-137-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-138-0x00007FFCB9AE0000-0x00007FFCB9AF0000-memory.dmpFilesize
64KB
-
memory/3888-139-0x00007FFCB9AE0000-0x00007FFCB9AF0000-memory.dmpFilesize
64KB
-
memory/3888-175-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-176-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-177-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB
-
memory/3888-178-0x00007FFCBBC70000-0x00007FFCBBC80000-memory.dmpFilesize
64KB