Analysis
-
max time kernel
101s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 09:21
Static task
static1
Behavioral task
behavioral1
Sample
RO10098.docx
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
RO10098.docx
Resource
win10v2004-20230220-en
General
-
Target
RO10098.docx
-
Size
292KB
-
MD5
473b3909e911de8c27ab621986c02d0e
-
SHA1
bd0366e2416de0fa75b77414b82f31e7ede37255
-
SHA256
5564cb2776b7336df157a5d8133543aa7a55c59550d9c8095f660e9945f4d93f
-
SHA512
bb41b10cc26a8426beba8285488a99898cd9b4a7a7e4abe4c99bb29444b3a4af3b72238fb7e0b7dd17741931a057edc834345d0da79a738e2817579306404cd4
-
SSDEEP
6144:yi7n5JRXQnl81RkVsBIPs5eK9U4zOu/lpW+1a5Uvk6pfo4sCy+ltOOCr0:yi75Ya1RkVTsr3OypRaOxJo4sUltOtr0
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2340 WINWORD.EXE 2340 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WINWORD.EXEdescription pid process Token: SeAuditPrivilege 2340 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2340 WINWORD.EXE 2340 WINWORD.EXE 2340 WINWORD.EXE 2340 WINWORD.EXE 2340 WINWORD.EXE 2340 WINWORD.EXE 2340 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RO10098.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\106FEA51.datFilesize
1KB
MD5a19e3005f2cf4408c6a0ef18419fd9cf
SHA12b2fe21480eae6c5bbc3bdc736e1186815fecffc
SHA25601188acaff9047e8b0e6293aa34350f74b8b27f425323323b3ebd16e0284a26e
SHA512f2c3dcc37e1868612cf73c976385c00d11c0b52db3846ab8a19d2fdf9cc0a0ec9e704da7607bb56076de7c57743f581d4ba56924994a89e692d20fe16b7ee7aa
-
memory/2340-133-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-134-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-135-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-136-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-137-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-138-0x00007FFA1C9F0000-0x00007FFA1CA00000-memory.dmpFilesize
64KB
-
memory/2340-139-0x00007FFA1C9F0000-0x00007FFA1CA00000-memory.dmpFilesize
64KB
-
memory/2340-191-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-192-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-194-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB
-
memory/2340-193-0x00007FFA1EA50000-0x00007FFA1EA60000-memory.dmpFilesize
64KB