c714df95288209ef3fbafe4f685c16629edea6bbf927c9ff522170c939916016

Analysis

max time kernel
117s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20062024_1448_20062024_NEW ORDER.docx
Size

16KB
MD5

0ec4a5cbc70d9e63dc8efc2197bc03fa
SHA1

24715d7a38a0e3b3495d6fa7bd1164897fe36257
SHA256

c714df95288209ef3fbafe4f685c16629edea6bbf927c9ff522170c939916016
SHA512

cfa6f5f43e48340e562ff47a8c1c7c73c46e96adf1b9452e252d4e20171a5a0c13175129ee401e217982d7d49f29df045b42ee93045d3e1acc188554c1f71403
SSDEEP

384:AyXKibkWUs8PL8wi4OEwH8TIbE91r2fRwJY7vi9EyPPT:AcK735P3DOqnYJ+OvsEyP7

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

MsoSync.exe

description pid pid_target process target process

Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2200 2172 MsoSync.exe WINWORD.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2200	2172	MsoSync.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEMsoSync.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsoSync.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

MsoSync.exeWINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsoSync.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2172 WINWORD.EXE
2172 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WINWORD.EXEMsoSync.exe

description pid process

Token: SeAuditPrivilege 2172 WINWORD.EXE
Token: SeAuditPrivilege 2200 MsoSync.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

MsoSync.exe

pid process

2200 MsoSync.exe
2200 MsoSync.exe
2200 MsoSync.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

MsoSync.exe

pid process

2200 MsoSync.exe
2200 MsoSync.exe
2200 MsoSync.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXEMsoSync.exe

pid process

2172 WINWORD.EXE
2172 WINWORD.EXE
2172 WINWORD.EXE
2172 WINWORD.EXE
2172 WINWORD.EXE
2172 WINWORD.EXE
2172 WINWORD.EXE
2172 WINWORD.EXE
2200 MsoSync.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description pid process target process

PID 2172 wrote to memory of 2200 2172 WINWORD.EXE MsoSync.exe
PID 2172 wrote to memory of 2200 2172 WINWORD.EXE MsoSync.exe

pid	process
2172	WINWORD.EXE
2172	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	2172	WINWORD.EXE
Token: SeAuditPrivilege	2200	MsoSync.exe

pid	process
2200	MsoSync.exe
2200	MsoSync.exe
2200	MsoSync.exe

pid	process
2200	MsoSync.exe
2200	MsoSync.exe
2200	MsoSync.exe

pid	process
2172	WINWORD.EXE
2172	WINWORD.EXE
2172	WINWORD.EXE
2172	WINWORD.EXE
2172	WINWORD.EXE
2172	WINWORD.EXE
2172	WINWORD.EXE
2172	WINWORD.EXE
2200	MsoSync.exe

description	pid	process	target process
PID 2172 wrote to memory of 2200	2172	WINWORD.EXE	MsoSync.exe
PID 2172 wrote to memory of 2200	2172	WINWORD.EXE	MsoSync.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\20062024_1448_20062024_NEW ORDER.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172

C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe
"C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe"
2⤵
- Process spawned unexpected child process
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2200

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb
Filesize
512KB

MD5
325e1595012b226a848547213e219378

SHA1
825d1e5c79b4c85555ab389ec6b9d9886669ca2c

SHA256
e82099ac3af6999cc2aef72858b9a6c3d4262fc4b0df8275a5225db57f6cc575

SHA512
062541a43218cacea5df470f079ffe6f7dc705d03645712df54ad5ddf49f3b52a32ed057332b87ac7b6c4198d1734fc653190bde8cbf36799c5b3892fa8c3c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb
Filesize
128B

MD5
93613f092b43447e50c65482aaa83cc0

SHA1
cc159612a0a4f7406cb9454beac572821a62e725

SHA256
7af07a3503b5c736e99c982e468b2c42a90b8f8eb990f00ff17f45f76a9ec427

SHA512
193043f2968c2ef0b62427e77306873c20ab270409bf37adc758f4b770d1908584ef9b48f07d0c0804e042a764e4c2ce644935e3ac855d41b264257af35ff023

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2172-11-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-1-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2172-5-0x00007FF9C60AD000-0x00007FF9C60AE000-memory.dmp

Filesize
4KB

Download
memory/2172-6-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-83-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-9-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-0-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2172-79-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2172-8-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-3-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2172-10-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-14-0x00007FF983F80000-0x00007FF983F90000-memory.dmp

Filesize
64KB

Download
memory/2172-26-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-2-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2172-80-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2172-4-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2172-7-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-12-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-13-0x00007FF983F80000-0x00007FF983F90000-memory.dmp

Filesize
64KB

Download
memory/2200-41-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-43-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2200-44-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2200-42-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2200-40-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2200-36-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-50-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2200-54-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-55-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-57-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-56-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-58-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/2200-37-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-39-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/2200-38-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download