cddb9e749edefbdc868a546d1e7dcab73ba704d3c759f085b532642fa2e42de3

General

Target

2023-03-08_1254.doc
Size

515.3MB
MD5

56fa3a6a45a6c48a6582c8ce100cb094
SHA1

79fa05d995a6dab74a6b85259ad83533fb4ecd08
SHA256

b4337a636049658bd281de947f0357e33efa17f3f80c3904d959cf6777df001d
SHA512

c65a4eab76532c4ca48eefe5814affc614b990eb2eac3e7cbcfe308ef9f0521382c9562be5aed5c338ddb9d761c3da66eda9de4638990c794bd33bc640252b35
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	30	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	32	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	35	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	52	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
892	WINWORD.EXE
892	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE
892	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-08_1254.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCDB689.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
843f1d9714465d77421262ea6c65a1ab

SHA1
85f4bd94ff4193adf2b3de8994126e9dda817ddf

SHA256
c51df15115aa99de9b1fa3d3ede4f5c18dda4208eebf479b67c9027af25d4dc3

SHA512
68fc4573cbcf76ae88a8d1a87efe38cde403d9cc38999f5ee7d8be7e4044acffac6a5feadc11f690c0f56af21f668595322c12cb42fd9a7b5e1623059a453e02

Download Submit
memory/892-1-0x00007FFCE634D000-0x00007FFCE634E000-memory.dmp

Filesize
4KB

Download
memory/892-7-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-17-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download
memory/892-12-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-13-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-14-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-11-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-15-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-10-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-16-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download
memory/892-9-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-8-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-6-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-0-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/892-4-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/892-3-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/892-30-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-35-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-34-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-33-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-36-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-37-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-38-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-47-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-48-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-49-0x00007FFCE634D000-0x00007FFCE634E000-memory.dmp

Filesize
4KB

Download
memory/892-50-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-2-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/892-56-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/892-5-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads