95a6d5e9fd4e40d8f297e8c5d623fa5ce5e4b4eb1f150b19bec81bd28fc90f2a

General

Target

TT082112.docx
Size

10KB
MD5

86255e186d21c74c14693a644dce28a6
SHA1

d4177a60f4884035258c7de621d3c3ec9421e282
SHA256

f2d27ce8d345c73931ceae72ca3100eda4481545a6e7d584bc20d19193dca2c0
SHA512

a87be6b4233040aef5790a0e68e05459dc3d07a295b7eed8f4b88ba00a6d3429769fe54778779dca8599bd5ba6f8ad64110c0fbecbed09782ee3655c9d6bfdc1
SSDEEP

192:ScIMmtP12G/bWvsq2VwO1KrdlJFOyX3OR:SPXjmx2KO8jJFlnK

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4756 WINWORD.EXE
4756 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 4756 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

4756 WINWORD.EXE
4756 WINWORD.EXE
4756 WINWORD.EXE
4756 WINWORD.EXE
4756 WINWORD.EXE
4756 WINWORD.EXE

pid	process
4756	WINWORD.EXE
4756	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	4756	WINWORD.EXE

pid	process
4756	WINWORD.EXE
4756	WINWORD.EXE
4756	WINWORD.EXE
4756	WINWORD.EXE
4756	WINWORD.EXE
4756	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TT082112.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4756-0-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-1-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-3-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-4-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-2-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-7-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-6-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-8-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-5-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-9-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-10-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-12-0x00007FFBE7280000-0x00007FFBE7290000-memory.dmp

Filesize
64KB

Download
memory/4756-11-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-13-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-15-0x00007FFBE7280000-0x00007FFBE7290000-memory.dmp

Filesize
64KB

Download
memory/4756-14-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-16-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-17-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-19-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-18-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-20-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-21-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-23-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-22-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-42-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-43-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-44-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-68-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-69-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-71-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-70-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-73-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-72-0x00007FFBE9830000-0x00007FFBE9840000-memory.dmp

Filesize
64KB

Download
memory/4756-75-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download
memory/4756-74-0x00007FFC297B0000-0x00007FFC299A5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads