f506b80e90477b4a92dff08b151f9edf795a0647829cdf92e2680c782da716ba

General

Target

f506b80e90477b4a92dff08b151f9edf795a0647829cdf92e2680c782da716ba.doc
Size

38KB
MD5

11e087de003e73d5268b8fb58dcdd591
SHA1

6ce4843283e8359a2db9a5442a044667ba74dbc1
SHA256

f506b80e90477b4a92dff08b151f9edf795a0647829cdf92e2680c782da716ba
SHA512

994f333bb81b2352042ad8b4eeea906fa873de3d402e9e187dbf78958e11eceade8466d7246741759991d8223b0f3a9166406913219e11347df577da1866044a
SSDEEP

384:fe+86SiSwvxjk+tzC0OR/egp/SO0CZfosdOKHXyknWzOg0jFBt4/:/Vxw+tKR/DhZfosdN3yknqnA

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
208	WINWORD.EXE
208	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE
208	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f506b80e90477b4a92dff08b151f9edf795a0647829cdf92e2680c782da716ba.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCDF4E3.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/208-15-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-1-0x00007FFDF8B8D000-0x00007FFDF8B8E000-memory.dmp

Filesize
4KB

Download
memory/208-0-0x00007FFDB8B70000-0x00007FFDB8B80000-memory.dmp

Filesize
64KB

Download
memory/208-5-0x00007FFDB8B70000-0x00007FFDB8B80000-memory.dmp

Filesize
64KB

Download
memory/208-9-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-12-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-11-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-13-0x00007FFDB6590000-0x00007FFDB65A0000-memory.dmp

Filesize
64KB

Download
memory/208-10-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-8-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-7-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-6-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-2-0x00007FFDB8B70000-0x00007FFDB8B80000-memory.dmp

Filesize
64KB

Download
memory/208-4-0x00007FFDB8B70000-0x00007FFDB8B80000-memory.dmp

Filesize
64KB

Download
memory/208-3-0x00007FFDB8B70000-0x00007FFDB8B80000-memory.dmp

Filesize
64KB

Download
memory/208-20-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-17-0x00007FFDB6590000-0x00007FFDB65A0000-memory.dmp

Filesize
64KB

Download
memory/208-18-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-14-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-24-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-34-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-19-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-41-0x00007FFDF8B8D000-0x00007FFDF8B8E000-memory.dmp

Filesize
4KB

Download
memory/208-42-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-43-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-49-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download
memory/208-16-0x00007FFDF8AF0000-0x00007FFDF8CE5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads