773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5

General

Target

773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5.docx
Size

141KB
MD5

584410ce253da7a7a165233ca100ca83
SHA1

4be0e18e971f0c8443aba983826312f1a9103f0a
SHA256

773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5
SHA512

66555af131b8d9474bc3db81227b3ef4e74a7b3bc678b5715a54b52017d99f266729cbc2358425d09bcded014f6682633d30f2e1122a140faa54527c221348ae
SSDEEP

3072:nHjiNnE9xcCSbQcFyjZ9p7p6+1Ghfu+uUsw8Okcf:HedEFSbQ4gZ939Ou+uUsw7ki

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4792	WINWORD.EXE
4792	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeAuditPrivilege	4792	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4792	WINWORD.EXE
4792	WINWORD.EXE
4792	WINWORD.EXE
4792	WINWORD.EXE
4792	WINWORD.EXE
4792	WINWORD.EXE
4792	WINWORD.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D2418591.emf

Filesize
16KB

MD5
767d8595d67d70f6c19ed869df119765

SHA1
8ceb76d98dde5e69bf541623ec5ac6f034e6edb8

SHA256
8a05aef60aa3ca524164d3c1c0ac369a2b42d00293b33533cfce3d5576877ef8

SHA512
794ce1be4440925efad4aa7823af3eca8b891109118a5e09414fc5a14e310db8af316d3e552ba22dac9bd0bd692f00955616cfdaec21c872f0a9377f3c61fc21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\opningnewthingstobegreatattitudewithentirethingstogoreturrnwithallnewmanufacturesarehere________greatwayofreturnhim[1].doc

Filesize
92KB

MD5
7da751285a673c1b6b0459614a411267

SHA1
a340c1b262b48dd4b1726fab58b304de0c258acd

SHA256
ae69a637db88457f0e6f1b67e2f3b55b88bd95af602f4b1afe7dffc617593f2b

SHA512
948e0702adbbd5424a8cda0b246d52f45b642745a39a04708527d0968b3481c181b380d86040200508ae77d4fcaeb9ea6745f8568b375425f5ff0d8ab82074d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD691.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
335B

MD5
dd737a3b208e4baddf5b512e75e5dbf1

SHA1
fbc1eb011a24c3da195099dd4715eb6eba1c2a37

SHA256
70a4d7fe78f786617d56d55ae2a3bc34fc71850ad70d9e1a59b35e2543e03653

SHA512
67a662c07a3ce99b6f28f3038fca69f6e78e56e7f015e0f81c3d3eb4593fdcb5cbcfd353784da53b0e8e939bfccfdfc136999d215252b2d0e78adea51b824157

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
cc3214c11fe0763826d87ec4821695b6

SHA1
9b4bd90e8ef195e6a822728bb7ee951dea46f8d1

SHA256
1afe223944abfd69064b31de835265a88de0aa831b213cc714896787155c1b3e

SHA512
d184414db93b4744f691abf9656113cbe85fd4f6abd0a722484034e34ca9a195b1a70745b6c041c06b882fc5ac1da4f54ad263fb829b131d5a5739c26c6fc10d

Download Submit
memory/4792-21-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-17-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-13-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-14-0x00007FF965280000-0x00007FF965290000-memory.dmp

Filesize
64KB

Download
memory/4792-10-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-9-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-16-0x00007FF965280000-0x00007FF965290000-memory.dmp

Filesize
64KB

Download
memory/4792-20-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-0-0x00007FF967730000-0x00007FF967740000-memory.dmp

Filesize
64KB

Download
memory/4792-19-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-18-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-11-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-15-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-8-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-7-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-6-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-12-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-3-0x00007FF967730000-0x00007FF967740000-memory.dmp

Filesize
64KB

Download
memory/4792-4-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp

Filesize
4KB

Download
memory/4792-5-0x00007FF967730000-0x00007FF967740000-memory.dmp

Filesize
64KB

Download
memory/4792-1-0x00007FF967730000-0x00007FF967740000-memory.dmp

Filesize
64KB

Download
memory/4792-99-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

Filesize
2.0MB

Download
memory/4792-2-0x00007FF967730000-0x00007FF967740000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads