c714df95288209ef3fbafe4f685c16629edea6bbf927c9ff522170c939916016

Analysis

max time kernel
116s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c714df95288209ef3fbafe4f685c16629edea6bbf927c9ff522170c939916016.docx
Size

16KB
MD5

0ec4a5cbc70d9e63dc8efc2197bc03fa
SHA1

24715d7a38a0e3b3495d6fa7bd1164897fe36257
SHA256

c714df95288209ef3fbafe4f685c16629edea6bbf927c9ff522170c939916016
SHA512

cfa6f5f43e48340e562ff47a8c1c7c73c46e96adf1b9452e252d4e20171a5a0c13175129ee401e217982d7d49f29df045b42ee93045d3e1acc188554c1f71403
SSDEEP

384:AyXKibkWUs8PL8wi4OEwH8TIbE91r2fRwJY7vi9EyPPT:AcK735P3DOqnYJ+OvsEyP7

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

MsoSync.exe

description pid pid_target process target process

Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1956 3288 MsoSync.exe WINWORD.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1956	3288	MsoSync.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEMsoSync.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsoSync.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

MsoSync.exeWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsoSync.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	MsoSync.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3288 WINWORD.EXE
3288 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WINWORD.EXEMsoSync.exe

description pid process

Token: SeAuditPrivilege 3288 WINWORD.EXE
Token: SeAuditPrivilege 1956 MsoSync.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

MsoSync.exe

pid process

1956 MsoSync.exe
1956 MsoSync.exe
1956 MsoSync.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

MsoSync.exe

pid process

1956 MsoSync.exe
1956 MsoSync.exe
1956 MsoSync.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXEMsoSync.exe

pid process

3288 WINWORD.EXE
3288 WINWORD.EXE
3288 WINWORD.EXE
3288 WINWORD.EXE
3288 WINWORD.EXE
3288 WINWORD.EXE
3288 WINWORD.EXE
3288 WINWORD.EXE
1956 MsoSync.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description pid process target process

PID 3288 wrote to memory of 1956 3288 WINWORD.EXE MsoSync.exe
PID 3288 wrote to memory of 1956 3288 WINWORD.EXE MsoSync.exe

pid	process
3288	WINWORD.EXE
3288	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	3288	WINWORD.EXE
Token: SeAuditPrivilege	1956	MsoSync.exe

pid	process
1956	MsoSync.exe
1956	MsoSync.exe
1956	MsoSync.exe

pid	process
1956	MsoSync.exe
1956	MsoSync.exe
1956	MsoSync.exe

pid	process
3288	WINWORD.EXE
3288	WINWORD.EXE
3288	WINWORD.EXE
3288	WINWORD.EXE
3288	WINWORD.EXE
3288	WINWORD.EXE
3288	WINWORD.EXE
3288	WINWORD.EXE
1956	MsoSync.exe

description	pid	process	target process
PID 3288 wrote to memory of 1956	3288	WINWORD.EXE	MsoSync.exe
PID 3288 wrote to memory of 1956	3288	WINWORD.EXE	MsoSync.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c714df95288209ef3fbafe4f685c16629edea6bbf927c9ff522170c939916016.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288

C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe
"C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe"
2⤵
- Process spawned unexpected child process
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb
Filesize
512KB

MD5
e050052a6446137b38c1b425b660d10b

SHA1
1352a2321229bef8985747d7bb6fcd4a4cb619ca

SHA256
45c5a3fb0dc85872eec80a44425d047f0b7dba8d572ded1d79c258c32bc3ff57

SHA512
343258ed4e2a6f2a0bbfe185c8ff147f3b4599c5faa9f73d8bc837cd05bb5e0b89ad31caa2799792a779934e5964170ba2de9b9f3a3c4aeda4c19fde13eb96a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb
Filesize
128B

MD5
93613f092b43447e50c65482aaa83cc0

SHA1
cc159612a0a4f7406cb9454beac572821a62e725

SHA256
7af07a3503b5c736e99c982e468b2c42a90b8f8eb990f00ff17f45f76a9ec427

SHA512
193043f2968c2ef0b62427e77306873c20ab270409bf37adc758f4b770d1908584ef9b48f07d0c0804e042a764e4c2ce644935e3ac855d41b264257af35ff023

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1956-38-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-39-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-41-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-40-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-61-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/1956-59-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-60-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-58-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-57-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/1956-53-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/1956-48-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/1956-42-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/1956-47-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/1956-45-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/1956-43-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/1956-44-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-14-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-3-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/3288-6-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-82-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/3288-1-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/3288-28-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-16-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-15-0x00007FF983F80000-0x00007FF983F90000-memory.dmp

Filesize
64KB

Download
memory/3288-12-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-2-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/3288-4-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/3288-0-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/3288-13-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-11-0x00007FF983F80000-0x00007FF983F90000-memory.dmp

Filesize
64KB

Download
memory/3288-9-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-10-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-8-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-7-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download
memory/3288-83-0x00007FF986090000-0x00007FF9860A0000-memory.dmp

Filesize
64KB

Download
memory/3288-5-0x00007FF9C60AD000-0x00007FF9C60AE000-memory.dmp

Filesize
4KB

Download
memory/3288-86-0x00007FF9C6010000-0x00007FF9C6205000-memory.dmp

Filesize
2.0MB

Download