3adacca54c6fe4bb905e233e48dffd8f6d03078d3d2d309d40e2e67a04a70db1

General

Target

Новый щит и новый меч Вооруженные Силы России и США.doc
Size

80KB
MD5

5cc125e416646bb04e253793b52252c0
SHA1

5f9b986c6792de82bdb992c7504ae090b84d6d52
SHA256

6c85434279ce173bf41eec77ff1f7117f10eb8071c9e8cfeb5c521ed1ef5066c
SHA512

17e8961fb1700416e43908c351e5d6d4d74d1a49c8ea03e8eab4ffb00389834075a204b5099ed7e01a38f45483df16a2ebec3ddb2472ec5085a0657cd94b5d97
SSDEEP

768:089Aa2aJPfDYB0LjqRj/LtwqKsQ5OqOS0a4FMBRsKCBV0:08yLQqZd4n4F+5IV0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2448	WINWORD.EXE
2448	WINWORD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE
2448	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Новый щит и новый меч Вооруженные Силы России и США.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
a5164319bebbac7df8defa39c6297625

SHA1
3e929b76dbe8f2baaf74222775b3642f7075f527

SHA256
7142be91ba6a4fdf8a45acff1e2f5c92db784129bcbb9ef92a377a43227502e1

SHA512
a06bd762e839b135ab338165c858e9a7c6ff91c86164ec3bdd960996f281c45746a05d116c576d657f267f3e8b63624a7dc6607f63fab891da7ef2599493f3a4

Download Submit
memory/2448-8-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-62-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-6-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-7-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-5-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-0-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-10-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-13-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-15-0x00007FFA03430000-0x00007FFA03440000-memory.dmp

Filesize
64KB

Download
memory/2448-14-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-16-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-12-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-3-0x00007FFA4580D000-0x00007FFA4580E000-memory.dmp

Filesize
4KB

Download
memory/2448-18-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-19-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-11-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-9-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-4-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-20-0x00007FFA03430000-0x00007FFA03440000-memory.dmp

Filesize
64KB

Download
memory/2448-2-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-1-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-41-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-59-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-60-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-17-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download
memory/2448-61-0x00007FFA057F0000-0x00007FFA05800000-memory.dmp

Filesize
64KB

Download
memory/2448-63-0x00007FFA45770000-0x00007FFA45965000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads