Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2023, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
oświadczenia zakup bez faktury.docx
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
oświadczenia zakup bez faktury.docx
Resource
win10v2004-20230703-en
General
-
Target
oświadczenia zakup bez faktury.docx
-
Size
12KB
-
MD5
b77b3b4d9982ad02f31038cf96b67564
-
SHA1
d7d7339563e9f7c2286735ae02a20c8d0b7df02c
-
SHA256
9c16fac47b85ea8dadbe2a4725f6c8a4f4b79fe1c11308ea2678855252265d3c
-
SHA512
5fb84244140999e6bcc73331aef6bd67bb9d090616429360e654337755afc6e0796dd9592d0afdb8f5ef734c690d1429774fcfdf5ad230b31a74b19c452a9a52
-
SSDEEP
192:CtI2K0KC4KidzYpM5rw3rnX9f+tMExGZicFsSE+qJBl5yAp:aI2cjKmYi5rwbX9WtMEuicFRMzTyAp
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3752 WINWORD.EXE 3752 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE 3752 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\oświadczenia zakup bez faktury.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3752