897ad0091578934c82b7b291a7c577d64b789bda5de05fa148ce0a0c2d7e495e

General

Target

897ad0091578934c82b7b291a7c577d64b789bda5de05fa148ce0a0c2d7e495e.docx
Size

416KB
MD5

3c691262c5feedd3c93c4ec897dd0c72
SHA1

542ec921aa580dbafc9fae77ee5a398c966785d1
SHA256

897ad0091578934c82b7b291a7c577d64b789bda5de05fa148ce0a0c2d7e495e
SHA512

e9801a149a3df622cf0f3b2beef5750e337a6dfff5a085b043ee96b559a41dc9ab0065f0c3fa9f26e313df5d1ea54332f50d24c55c0843f5f76a659bab2a2032
SSDEEP

6144:mHrxSWGkJ6lOmrKli3+hwYFqt43giHpPqVph0vy+Mtq43gW+qv43g4J:mHlBLJuOt2+rgiIhEtggW+q0g4J

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3760 WINWORD.EXE
3760 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 3760 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

3760 WINWORD.EXE
3760 WINWORD.EXE
3760 WINWORD.EXE
3760 WINWORD.EXE
3760 WINWORD.EXE
3760 WINWORD.EXE
3760 WINWORD.EXE

pid	process
3760	WINWORD.EXE
3760	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	3760	WINWORD.EXE

pid	process
3760	WINWORD.EXE
3760	WINWORD.EXE
3760	WINWORD.EXE
3760	WINWORD.EXE
3760	WINWORD.EXE
3760	WINWORD.EXE
3760	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 3760 wrote to memory of 3272	3760	WINWORD.EXE	splwow64.exe
PID 3760 wrote to memory of 3272	3760	WINWORD.EXE	splwow64.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\897ad0091578934c82b7b291a7c577d64b789bda5de05fa148ce0a0c2d7e495e.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\59801CBA.emf

Filesize
1.4MB

MD5
bdb651a93e94a128e9fc7fb1b71ef63f

SHA1
aff0794615a836dec0b72d8f6947a4178d02f52d

SHA256
4b18541f2c8d6344b62dec12138458e1649fea21c672cfda37b27afe056b9caa

SHA512
ff3bfd7ecf0c4662f6749f1a51894130db5d0406d5870711a481463d64ed5f89ae8f81972c6838922e69f70ae2c4cabe0b59341c7edb84f4c1d48d9fef130a85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\870BBEF9.emf

Filesize
3KB

MD5
4a103fc1809c8ea381d2acb5380ef4f6

SHA1
6c81d37798c4d78c64e7d3ef7eb2acb317c9ff67

SHA256
1ab8f5abd845ffd0c61a61bb09bfcf20569b80b4496bccb58c623753cf40485c

SHA512
77da8ab022505d77f89749e97628caf4dd8414251cb673598acba8f7d30d1889037fab30094a6ce7dc47293697a6bef28b92364d00129b59d2fc3711c82650f5

Download Submit
memory/3760-9-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-8-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

Filesize
64KB

Download
memory/3760-4-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-5-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-6-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

Filesize
64KB

Download
memory/3760-7-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-0-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

Filesize
64KB

Download
memory/3760-1-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

Filesize
64KB

Download
memory/3760-10-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-11-0x00007FFE704A0000-0x00007FFE704B0000-memory.dmp

Filesize
64KB

Download
memory/3760-12-0x00007FFE704A0000-0x00007FFE704B0000-memory.dmp

Filesize
64KB

Download
memory/3760-3-0x00007FFE72BF0000-0x00007FFE72C00000-memory.dmp

Filesize
64KB

Download
memory/3760-2-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-73-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-75-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download
memory/3760-76-0x00007FFEB2B70000-0x00007FFEB2D65000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads