15723c9ed5323a6dc5b7a407c37000456bff531f06bd9e7732278eb518445547

General

Target

15723c9ed5323a6dc5b7a407c37000456bff531f06bd9e7732278eb518445547.rtf
Size

114KB
MD5

6fe3c24853e9de94688a2311999ba946
SHA1

c4383b6caefcb3050ee009394ed1ae07c4f8fd6e
SHA256

15723c9ed5323a6dc5b7a407c37000456bff531f06bd9e7732278eb518445547
SHA512

a1b12f0e1a44d7743d6159f71ab116c8b9e8499cb2d52bc8d1ae3e9f6bc91c3f16788c9be5526052f6bb23b65ceb730a9a46fa2ccd07de05dc30d51f7e9e81a3
SSDEEP

768:u+e7d8wnZX6sQ1j3ArcSGCTl4JkwHKTZ/rR7APQ8c:J/wnZ9Q1UrJWHaFAPQ3

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
804	WINWORD.EXE
804	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE
804	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\15723c9ed5323a6dc5b7a407c37000456bff531f06bd9e7732278eb518445547.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD549C.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
c6e7a9ef7d000aa3e66efef98fce98e9

SHA1
1daa3d9d9338f963048c4975ab17c253d62e6787

SHA256
a8ffbf36b1c8413157bc23e94055d6f876a78df8811c42819cc1fed906ed861b

SHA512
ba060bd32326e47e8b652b7954d3d9d920585c6f46bd36cfe1cfedd40924c6f2840c6ccb242ad2099164ebd9d839af589bf51b939dd7774077d3f1693d4085eb

Download Submit
memory/804-16-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-17-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-8-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-10-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-9-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-12-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-14-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-13-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-11-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-0-0x00007FFB1F2D0000-0x00007FFB1F2E0000-memory.dmp

Filesize
64KB

Download
memory/804-18-0x00007FFB1C970000-0x00007FFB1C980000-memory.dmp

Filesize
64KB

Download
memory/804-4-0x00007FFB1F2D0000-0x00007FFB1F2E0000-memory.dmp

Filesize
64KB

Download
memory/804-15-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-7-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-6-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-5-0x00007FFB1F2D0000-0x00007FFB1F2E0000-memory.dmp

Filesize
64KB

Download
memory/804-19-0x00007FFB1C970000-0x00007FFB1C980000-memory.dmp

Filesize
64KB

Download
memory/804-1-0x00007FFB5F2ED000-0x00007FFB5F2EE000-memory.dmp

Filesize
4KB

Download
memory/804-37-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-38-0x00007FFB5F2ED000-0x00007FFB5F2EE000-memory.dmp

Filesize
4KB

Download
memory/804-39-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-43-0x00007FFB5F250000-0x00007FFB5F445000-memory.dmp

Filesize
2.0MB

Download
memory/804-3-0x00007FFB1F2D0000-0x00007FFB1F2E0000-memory.dmp

Filesize
64KB

Download
memory/804-2-0x00007FFB1F2D0000-0x00007FFB1F2E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads