Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 13:18
Static task
static1
Behavioral task
behavioral1
Sample
UBIN0231541484.docx
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
UBIN0231541484.docx
Resource
win10v2004-20230221-en
General
-
Target
UBIN0231541484.docx
-
Size
14KB
-
MD5
68ec0315e8c7d6a99bc11d1c3165f1ea
-
SHA1
8fb882147e3c5b3ff413b022358916492c071855
-
SHA256
d76cc47a412eb217e437f4292b240e3858d35a927048e6240b815eaea2aa1b79
-
SHA512
6127459e215b67939e95eb6796ecd14579b4158269b1ff09b68d2aff7f324fa0ac9f6b9889b614d13fc2c675ebea115f4c31e25e77ad3989ab62b93a0ef08bc1
-
SSDEEP
192:4fiPeafL1ef4sfFONVJ0spH3RfuAfD7ZtNYg3dx5BO8Qk5i9AE/y7faVj1qqfLf3:SU1wYZ//368Qk50a+FJ3W7mn/
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4100 WINWORD.EXE 4100 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WINWORD.EXEdescription pid process Token: SeAuditPrivilege 4100 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4100 WINWORD.EXE 4100 WINWORD.EXE 4100 WINWORD.EXE 4100 WINWORD.EXE 4100 WINWORD.EXE 4100 WINWORD.EXE 4100 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\UBIN0231541484.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\85571CDD.datFilesize
1KB
MD5a19e3005f2cf4408c6a0ef18419fd9cf
SHA12b2fe21480eae6c5bbc3bdc736e1186815fecffc
SHA25601188acaff9047e8b0e6293aa34350f74b8b27f425323323b3ebd16e0284a26e
SHA512f2c3dcc37e1868612cf73c976385c00d11c0b52db3846ab8a19d2fdf9cc0a0ec9e704da7607bb56076de7c57743f581d4ba56924994a89e692d20fe16b7ee7aa
-
memory/4100-133-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-134-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-135-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-136-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-137-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-138-0x00007FFCE00F0000-0x00007FFCE0100000-memory.dmpFilesize
64KB
-
memory/4100-139-0x00007FFCE00F0000-0x00007FFCE0100000-memory.dmpFilesize
64KB
-
memory/4100-191-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-192-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-193-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB
-
memory/4100-194-0x00007FFCE28F0000-0x00007FFCE2900000-memory.dmpFilesize
64KB