Analysis
-
max time kernel
137s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:12
Behavioral task
behavioral1
Sample
7be9ef61632edc0f2fc6ad59d64ad69dbffbd05013a80ab1dfbb6bd8a6090b66.docm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7be9ef61632edc0f2fc6ad59d64ad69dbffbd05013a80ab1dfbb6bd8a6090b66.docm
Resource
win10v2004-20240508-en
General
-
Target
7be9ef61632edc0f2fc6ad59d64ad69dbffbd05013a80ab1dfbb6bd8a6090b66.docm
-
Size
106KB
-
MD5
0bd1328012301d04bdc921acb321b820
-
SHA1
724612a3c88f187aa000efe4ff4e9e04c9553696
-
SHA256
7be9ef61632edc0f2fc6ad59d64ad69dbffbd05013a80ab1dfbb6bd8a6090b66
-
SHA512
d588760ba4fb450a41563849ec10da311ef317c80da1e816b5d88198aef35379fd15f63512620fa7514f7d46f719afc07bce5fff7690ae6336e5a7d747e7d22f
-
SSDEEP
1536:FCuLaHmmF7tG8Q/qk8fowr/5mUpKNEteuEC5/ThAoLCAJZSfx6BrqbyGfh:hLIt7tD/rRmCK6guEC5/ThAQSfxSuGQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4180 WINWORD.EXE 4180 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
WINWORD.EXEpid process 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7be9ef61632edc0f2fc6ad59d64ad69dbffbd05013a80ab1dfbb6bd8a6090b66.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4180-1-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmpFilesize
64KB
-
memory/4180-2-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmpFilesize
64KB
-
memory/4180-3-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmpFilesize
64KB
-
memory/4180-0-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmpFilesize
64KB
-
memory/4180-4-0x00007FFEC8050000-0x00007FFEC8060000-memory.dmpFilesize
64KB
-
memory/4180-5-0x00007FFF0806D000-0x00007FFF0806E000-memory.dmpFilesize
4KB
-
memory/4180-6-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-7-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-8-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-10-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-9-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-11-0x00007FFEC5C10000-0x00007FFEC5C20000-memory.dmpFilesize
64KB
-
memory/4180-12-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-13-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-14-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-15-0x00007FFEC5C10000-0x00007FFEC5C20000-memory.dmpFilesize
64KB
-
memory/4180-16-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-17-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-18-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-19-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-22-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-21-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-20-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-33-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB
-
memory/4180-34-0x00007FFF07FD0000-0x00007FFF081C5000-memory.dmpFilesize
2.0MB