f2d27ce8d345c73931ceae72ca3100eda4481545a6e7d584bc20d19193dca2c0

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86255e186d21c74c14693a644dce28a6.docx
Size

10KB
MD5

86255e186d21c74c14693a644dce28a6
SHA1

d4177a60f4884035258c7de621d3c3ec9421e282
SHA256

f2d27ce8d345c73931ceae72ca3100eda4481545a6e7d584bc20d19193dca2c0
SHA512

a87be6b4233040aef5790a0e68e05459dc3d07a295b7eed8f4b88ba00a6d3429769fe54778779dca8599bd5ba6f8ad64110c0fbecbed09782ee3655c9d6bfdc1
SSDEEP

192:ScIMmtP12G/bWvsq2VwO1KrdlJFOyX3OR:SPXjmx2KO8jJFlnK

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4908 WINWORD.EXE
4908 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 4908 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

4908 WINWORD.EXE
4908 WINWORD.EXE
4908 WINWORD.EXE
4908 WINWORD.EXE
4908 WINWORD.EXE
4908 WINWORD.EXE

pid	process
4908	WINWORD.EXE
4908	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	4908	WINWORD.EXE

pid	process
4908	WINWORD.EXE
4908	WINWORD.EXE
4908	WINWORD.EXE
4908	WINWORD.EXE
4908	WINWORD.EXE
4908	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\86255e186d21c74c14693a644dce28a6.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4908-0-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-2-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-1-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-5-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-7-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-6-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-8-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-9-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-10-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-13-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-15-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-17-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-16-0x00007FFFBAB00000-0x00007FFFBAB10000-memory.dmp

Filesize
64KB

Download
memory/4908-20-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-19-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-22-0x00007FFFBAB00000-0x00007FFFBAB10000-memory.dmp

Filesize
64KB

Download
memory/4908-21-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-18-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-14-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-12-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-11-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-4-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-3-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-41-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-42-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-43-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-71-0x00007FFFFD210000-0x00007FFFFD405000-memory.dmp

Filesize
2.0MB

Download
memory/4908-70-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-69-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-68-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download
memory/4908-67-0x00007FFFBD290000-0x00007FFFBD2A0000-memory.dmp

Filesize
64KB

Download