b1e95a02dacd02c5821a7cff619f919623f222b85f27f5c60470f06f7b5eac85

General

Target

Payment Error.docx
Size

179KB
MD5

3d1c1d2836460cf9b648fafe778afc7c
SHA1

a6db7abf6061052b8fad3112a8d5570cd658f773
SHA256

b1e95a02dacd02c5821a7cff619f919623f222b85f27f5c60470f06f7b5eac85
SHA512

d1fbfa64020f97b6d1151559efdd9a47bcb32a58220763d0c25eef8b186110c48ddceb573ebdf678254163fcc8567c4ede18ac6c7d90d4e6ed04cbf06b42b25c
SSDEEP

3072:QiY5rj1ATug+mhTZMxjcFQ9csn4qAzYjDp/shKuikycBSRjR/Vx7XUgpxD:K5r/g+qZMpcFSQzYHut4dFrD

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3532	WINWORD.EXE
3532	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeAuditPrivilege	3532	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3532	WINWORD.EXE
3532	WINWORD.EXE
3532	WINWORD.EXE
3532	WINWORD.EXE
3532	WINWORD.EXE
3532	WINWORD.EXE
3532	WINWORD.EXE
3532	WINWORD.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment Error.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\zxcobizxc[1].dot

Filesize
469KB

MD5
0dbe0f99c69a2dbd0ec15c5199d73762

SHA1
4da131dcff2a5fd63eddf9b1742bd49b1fe08802

SHA256
f66ddd8a7bd34537428e518c38601da74769f6adf9ec7f671dd0195e2499d37a

SHA512
b04d315b61f13791af612ca58f6cd93b6fde0989bf9697d6cfa5491e841327acaf795fff45f60a9f860e8c4ebf8066ffe2242c4f0f5da20b6f96c193c82dd0c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD379D.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
309B

MD5
ebf464fb7c54090a5e14e56239e926e7

SHA1
8e9b23a77ac7258b60eebd5655a83138fefa6cca

SHA256
11dc47359a4d6344ad7b4b2d19a43c1e55f57783b45f657ca3fbcd9cb0c20d6e

SHA512
75a6a0f186130c7fe4e017f16396882783700f83c399123690c6c6a9ee4511f16805f5d99137b338c1d5a38492293e70994640a6e74317932d919bef0d9b0c28

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/3532-9-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-5-0x00007FFDEAA30000-0x00007FFDEAA40000-memory.dmp

Filesize
64KB

Download
memory/3532-13-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-4-0x00007FFDEAA30000-0x00007FFDEAA40000-memory.dmp

Filesize
64KB

Download
memory/3532-16-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-17-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-18-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-20-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-21-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-22-0x00007FFDE83A0000-0x00007FFDE83B0000-memory.dmp

Filesize
64KB

Download
memory/3532-19-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-15-0x00007FFDE83A0000-0x00007FFDE83B0000-memory.dmp

Filesize
64KB

Download
memory/3532-14-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-11-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-3-0x00007FFDEAA30000-0x00007FFDEAA40000-memory.dmp

Filesize
64KB

Download
memory/3532-2-0x00007FFDEAA30000-0x00007FFDEAA40000-memory.dmp

Filesize
64KB

Download
memory/3532-1-0x00007FFDEAA30000-0x00007FFDEAA40000-memory.dmp

Filesize
64KB

Download
memory/3532-0-0x00007FFE2AA4D000-0x00007FFE2AA4E000-memory.dmp

Filesize
4KB

Download
memory/3532-12-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-10-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-8-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-6-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-88-0x00007FFE2AA4D000-0x00007FFE2AA4E000-memory.dmp

Filesize
4KB

Download
memory/3532-89-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-91-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-90-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-95-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download
memory/3532-7-0x00007FFE2A9B0000-0x00007FFE2ABA5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads