98854e422f108649cb5f298bb82657f3d9f46ca7e7d69c807d0927b5161462c5

Analysis

max time kernel
167s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tax Invoice - Home HGP204765237 49810341.docm
Size

175KB
MD5

a7dd96ca52ab68de602259169f09883d
SHA1

1e062618b935796ad7867783c2e88cccbdaffae9
SHA256

98854e422f108649cb5f298bb82657f3d9f46ca7e7d69c807d0927b5161462c5
SHA512

03747504586a034fb2935f0053c1e562b48098e9cc76a1f4dd0f8a0603db6eb676e9035ef98b71567f636abbac9f3531d40631454dc5dec77e914b6e04afc0bc
SSDEEP

3072:Glc0mJ72ooA4J+USoCLYJ9D6ge4Ee6aGJX8kqroP873un6:Z0xo930JhNXOaGp8Bfin6

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1080	WINWORD.EXE
1080	WINWORD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1080	WINWORD.EXE
1080	WINWORD.EXE
1080	WINWORD.EXE
1080	WINWORD.EXE
1080	WINWORD.EXE
1080	WINWORD.EXE
1080	WINWORD.EXE
1080	WINWORD.EXE
1080	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Tax Invoice - Home HGP204765237 49810341.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-0-0x00007FFE6B7F0000-0x00007FFE6B800000-memory.dmp

Filesize
64KB

Download
memory/1080-1-0x00007FFE6B7F0000-0x00007FFE6B800000-memory.dmp

Filesize
64KB

Download
memory/1080-3-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-2-0x00007FFE6B7F0000-0x00007FFE6B800000-memory.dmp

Filesize
64KB

Download
memory/1080-4-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-5-0x00007FFE6B7F0000-0x00007FFE6B800000-memory.dmp

Filesize
64KB

Download
memory/1080-6-0x00007FFE6B7F0000-0x00007FFE6B800000-memory.dmp

Filesize
64KB

Download
memory/1080-7-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-8-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-9-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-10-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-11-0x00007FFE69580000-0x00007FFE69590000-memory.dmp

Filesize
64KB

Download
memory/1080-12-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-13-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-14-0x00007FFE69580000-0x00007FFE69590000-memory.dmp

Filesize
64KB

Download
memory/1080-15-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-16-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-17-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-18-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-19-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-20-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-22-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-23-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-21-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-36-0x000001C459720000-0x000001C45972A000-memory.dmp

Filesize
40KB

Download
memory/1080-37-0x00007FFE80E70000-0x00007FFE81811000-memory.dmp

Filesize
9.6MB

Download
memory/1080-38-0x000001C459700000-0x000001C459710000-memory.dmp

Filesize
64KB

Download
memory/1080-39-0x000001C471FD0000-0x000001C4720D0000-memory.dmp

Filesize
1024KB

Download
memory/1080-40-0x00007FFE80E70000-0x00007FFE81811000-memory.dmp

Filesize
9.6MB

Download
memory/1080-41-0x000001C459700000-0x000001C459710000-memory.dmp

Filesize
64KB

Download
memory/1080-48-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-49-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-50-0x00007FFEAB770000-0x00007FFEAB965000-memory.dmp

Filesize
2.0MB

Download
memory/1080-53-0x00007FFE80E70000-0x00007FFE81811000-memory.dmp

Filesize
9.6MB

Download
memory/1080-55-0x000001C459700000-0x000001C459710000-memory.dmp

Filesize
64KB

Download
memory/1080-56-0x000001C471FD0000-0x000001C4720D0000-memory.dmp

Filesize
1024KB

Download
memory/1080-57-0x000001C471FD0000-0x000001C4720D0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads