3e0ebb2b2f40a667f9d1cbf745cc77723c82b08fb9e9bfb8dccd39f7902b3b39

General

Target

=?Windows-1251?Q?=F0=E5=EA=EB=E0=EC=E0=F6=E8=FF=5F=E8=F1=F5=5F05=2E04=2E24=2Edoc?=.docx
Size

144KB
MD5

5667aa62833dd6ebd15da40130ab963d
SHA1

e50b2c20fe2151860c08cb1dba5022fbeb666c69
SHA256

d6fff4f67fb27def06611ed233e79f4b44a2c4daa320ae30c5054e98cf26af11
SHA512

51009f82ea1bf71fe56be1f8377aeba6ae09731e3457b5b86f7678fa240c33296d76a55608fcf420d5226e859349a90b0e9c6ad08ea9f50b514f80702d416028
SSDEEP

3072:MFWZl74EhdqpH7R4S8IuUih1pj8aSFhb9/roD5/pEzz0rEZNje:MFWZSOdqp2SaUUohblclGVZM

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3692 WINWORD.EXE
3692 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 3692 WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	3692	WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

WINWORD.EXE

pid	process
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE
3692	WINWORD.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\=_Windows-1251_Q_=F0=E5=EA=EB=E0=EC=E0=F6=E8=FF=5F=E8=F1=F5=5F05=2E04=2E24=2Edoc_=.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1BEC6028.rtf
Filesize
768KB

MD5
2e8a01026b5c298a9b1d2519241f0b16

SHA1
98b44cc10887c7cb63a769cbd258c45720eb7ef7

SHA256
0473ee221e38ba27330654ffb3cdd6476ff530881c303cc20d2efdff0c270e61

SHA512
aeaf88341f33a2f130730cd4871abbf9ae48a3932bab7a21d6376c7579bbe8dad7f226694134db5f0b19b2d9a3248c66e9c3f2adc21d432573f9624c4452451b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDBB53.tmp\iso690.xsl
Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
247B

MD5
f3ce20082cef98c54ddf0d322fc1e225

SHA1
804c807a9af41269e4ea4df8a989848f2363f1fe

SHA256
af3617795d063f9fad6567c915cba0415608ef277775768faaf4e936817aa9f9

SHA512
e68e0934f5f017bfd6ea56498816807ff661c44eb282c26c4fede39691a0a839d5efe04ffc75ce6c312115622286d125613f20edfcf0af4ecc5d2e164bf2ad9c

Download Submit
memory/3692-16-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-7-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-17-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-5-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-19-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-8-0x00007FF97D5D0000-0x00007FF97D5E0000-memory.dmp

Filesize
64KB

Download
memory/3692-9-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-12-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-11-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-10-0x00007FF97AE00000-0x00007FF97AE10000-memory.dmp

Filesize
64KB

Download
memory/3692-13-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-20-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-15-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-0-0x00007FF97D5D0000-0x00007FF97D5E0000-memory.dmp

Filesize
64KB

Download
memory/3692-6-0x00007FF97D5D0000-0x00007FF97D5E0000-memory.dmp

Filesize
64KB

Download
memory/3692-4-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-14-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-18-0x00007FF97AE00000-0x00007FF97AE10000-memory.dmp

Filesize
64KB

Download
memory/3692-21-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-22-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-23-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-24-0x00007FF9BCDC0000-0x00007FF9BCE8D000-memory.dmp

Filesize
820KB

Download
memory/3692-3-0x00007FF97D5D0000-0x00007FF97D5E0000-memory.dmp

Filesize
64KB

Download
memory/3692-2-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-67-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-68-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-71-0x00007FF9BD550000-0x00007FF9BD745000-memory.dmp

Filesize
2.0MB

Download
memory/3692-72-0x00007FF9BCDC0000-0x00007FF9BCE8D000-memory.dmp

Filesize
820KB

Download
memory/3692-1-0x00007FF97D5D0000-0x00007FF97D5E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads