4b172b60f17d77d8823fa4ca37a01908102b0bd8caaf181dc2279bb99a292ec4

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2023 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Automann- Order2#44096882.docx
Size

223KB
MD5

6289f704ef31176ffb10651e49aaec23
SHA1

39d2546f846c3289cda8ed8bd4f29d6605185bd9
SHA256

4b172b60f17d77d8823fa4ca37a01908102b0bd8caaf181dc2279bb99a292ec4
SHA512

deeeb1f625fe1b91873924f1ae6833b6e897d45d9b2d00df2e673fd971e9845a020f0c3564ebb3def4c1e20c6654a58dc77fc2e122b6fc01e999e45a5f8ea4a8
SSDEEP

6144:bkt6V6sxlSg/fO32zNOBb1SSAP0LKIQIPbR6w6Vab6W:It6V6sj/flzMpAP0LKILPV6w6sb6W

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4656 WINWORD.EXE
4656 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 4656 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4656 WINWORD.EXE
4656 WINWORD.EXE
4656 WINWORD.EXE
4656 WINWORD.EXE
4656 WINWORD.EXE
4656 WINWORD.EXE
4656 WINWORD.EXE

pid	process
4656	WINWORD.EXE
4656	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	4656	WINWORD.EXE

pid	process
4656	WINWORD.EXE
4656	WINWORD.EXE
4656	WINWORD.EXE
4656	WINWORD.EXE
4656	WINWORD.EXE
4656	WINWORD.EXE
4656	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Automann- Order2#44096882.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7F223AD3.emf
Filesize
3KB

MD5
4a103fc1809c8ea381d2acb5380ef4f6

SHA1
6c81d37798c4d78c64e7d3ef7eb2acb317c9ff67

SHA256
1ab8f5abd845ffd0c61a61bb09bfcf20569b80b4496bccb58c623753cf40485c

SHA512
77da8ab022505d77f89749e97628caf4dd8414251cb673598acba8f7d30d1889037fab30094a6ce7dc47293697a6bef28b92364d00129b59d2fc3711c82650f5

Download Submit
memory/4656-139-0x00007FFCE00F0000-0x00007FFCE0100000-memory.dmp

Filesize
64KB

Download
memory/4656-135-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-136-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-137-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-138-0x00007FFCE00F0000-0x00007FFCE0100000-memory.dmp

Filesize
64KB

Download
memory/4656-133-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-134-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-202-0x000001E06FE20000-0x000001E06FE47000-memory.dmp

Filesize
156KB

Download
memory/4656-243-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-244-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-245-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-246-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmp

Filesize
64KB

Download
memory/4656-247-0x000001E06FE20000-0x000001E06FE47000-memory.dmp

Filesize
156KB

Download