Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 19:53
Static task
static1
Behavioral task
behavioral1
Sample
78387cc1e95bef0171749438ebfd19cdfc916ce03a0f27406060d06f1ba5253c.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
78387cc1e95bef0171749438ebfd19cdfc916ce03a0f27406060d06f1ba5253c.doc
Resource
win10v2004-20240226-en
General
-
Target
78387cc1e95bef0171749438ebfd19cdfc916ce03a0f27406060d06f1ba5253c.doc
-
Size
1.8MB
-
MD5
d83dcc9a47f1c30d0df4d0a1b7b85b6e
-
SHA1
f912ca85a3b49faae40984c90d76d43ac62d571f
-
SHA256
78387cc1e95bef0171749438ebfd19cdfc916ce03a0f27406060d06f1ba5253c
-
SHA512
d88dfe3c04c953dac1fa6d1bd10dd86c8e21051a1a9368ee2ca00a8ebb2d29c4898836569785a1377a70696966ba675326cddc009a4c248b10b9fb50c8fb1f05
-
SSDEEP
24576:v6s/1ykvMMWg2Idvm+iWOLATbU1731h95hE1KxU1K9Fq1p1oN1h9l0U1IM1h9ZDl:v6s/tMMmV
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 264 WINWORD.EXE 264 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE 264 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\78387cc1e95bef0171749438ebfd19cdfc916ce03a0f27406060d06f1ba5253c.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:264