cb7a3b7718eade0df5db4b4f1043c7bc669931bee27725eb7533506fded68290

Analysis

max time kernel
199s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29cddab43e5fc32cee517d1afaf8017d.doc
Size

27KB
MD5

29cddab43e5fc32cee517d1afaf8017d
SHA1

8dfc978203fb6d5b11a201e500f2b462467454fe
SHA256

cb7a3b7718eade0df5db4b4f1043c7bc669931bee27725eb7533506fded68290
SHA512

1f4174e8965961b08ed7310dea4f1703424e3ce9ec78e390b9aaee3400ea358545ed3a0a81c16239670a1fe29a1630ff6ee3f27027dd8bed70ebdd82e67d23dc
SSDEEP

192:aONviilcDviLXTSpn70k1tfP1h/ktn4asFzgb1jLdTH3hT:LiilcojSRRt1h/k94asFzgb1jLdb

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2484	WINWORD.EXE
2484	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE
2484	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\29cddab43e5fc32cee517d1afaf8017d.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Filesize
24KB

MD5
08cdd24589bca5455984001cef15b436

SHA1
3b90471f0361699626442ba8ed25346852eb3cf1

SHA256
dbcc5c6cdd4b9cbcf6b860cdd14f76af793f320dda29ed66fe28c71c43d92b22

SHA512
ac4138285123411a8ad3c797f3fb3ec547ff23d4176236ef1560f991eb4b1f4fd4239e0f00b4d6ce9a7365378897c302864a51e7a6ee110d24e9085838c6a084

Download Submit
memory/2484-40-0x000001E3A10D0000-0x000001E3A20A0000-memory.dmp

Filesize
15.8MB

Download
memory/2484-59-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-9-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-8-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-6-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-5-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-4-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-3-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-2-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-0-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-11-0x00007FFCA6A30000-0x00007FFCA6A40000-memory.dmp

Filesize
64KB

Download
memory/2484-12-0x00007FFCA6A30000-0x00007FFCA6A40000-memory.dmp

Filesize
64KB

Download
memory/2484-24-0x000001E3A10D0000-0x000001E3A20A0000-memory.dmp

Filesize
15.8MB

Download
memory/2484-1-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-10-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-42-0x000001E3A10D0000-0x000001E3A20A0000-memory.dmp

Filesize
15.8MB

Download
memory/2484-66-0x000001E3A10D0000-0x000001E3A20A0000-memory.dmp

Filesize
15.8MB

Download
memory/2484-45-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-47-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-7-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-43-0x000001E3A10D0000-0x000001E3A20A0000-memory.dmp

Filesize
15.8MB

Download
memory/2484-65-0x000001E3A10D0000-0x000001E3A20A0000-memory.dmp

Filesize
15.8MB

Download
memory/2484-44-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-68-0x000001E3A10D0000-0x000001E3A20A0000-memory.dmp

Filesize
15.8MB

Download
memory/2484-92-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-93-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-94-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-95-0x00007FFCA9290000-0x00007FFCA92A0000-memory.dmp

Filesize
64KB

Download
memory/2484-96-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download
memory/2484-97-0x00007FFCE9210000-0x00007FFCE9405000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads