Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 15:17
Behavioral task
behavioral1
Sample
f7cc994cda13246b676a338d58411b25e6e2d9b727b37450726d71c002856ebe.doc
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f7cc994cda13246b676a338d58411b25e6e2d9b727b37450726d71c002856ebe.doc
Resource
win10v2004-20240226-en
General
-
Target
f7cc994cda13246b676a338d58411b25e6e2d9b727b37450726d71c002856ebe.doc
-
Size
16KB
-
MD5
456fa99e3a7bca6e4b0d5616a22dd537
-
SHA1
c3ab593872d1721212d738e3fe729ca8a83df1a2
-
SHA256
f7cc994cda13246b676a338d58411b25e6e2d9b727b37450726d71c002856ebe
-
SHA512
684781b387b358bd0925f23b808695631489a97573b1f27cd048b9f73b4683b770642bfe060c2ddbaa0af11f8d1ebafa3f3a1925587917028e225d7b05309fb3
-
SSDEEP
192:a4Fcja5LYOh8dc9EbQYpQZhG3ABFF2HPLPGsB2OmUyIUywgy0btGKabq+QXLEMea:BK2tEbUZh8cENbtGpqPL1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2844 WINWORD.EXE 2844 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE 2844 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f7cc994cda13246b676a338d58411b25e6e2d9b727b37450726d71c002856ebe.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2844