3f9c2a2bac5e829fd61db15ffda44387442cd91f7d84bb3d8e28b19c9ac098b0

Resubmissions

25-06-2024 10:40

240625-mqh9caxgnp 10

Analysis

max time kernel
121s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order-1351125X.docx
Size

16KB
MD5

e86424648b277754b74e507d51878e71
SHA1

e86498df0eb2a8514e0d55f9a33148779bf5b66d
SHA256

3f9c2a2bac5e829fd61db15ffda44387442cd91f7d84bb3d8e28b19c9ac098b0
SHA512

59c3c950a0f450b895b091fdf7f9664ed75124be0b7c699631b0a753bef062304151e1e58b3dfcc2032e819f339336c996482a6de94eee3e6327d24e8c51f84c
SSDEEP

384:0yXRxAxW4s8PL8wi4OEwH8TIbE91r2fR8JYbvimVmPFM:0cRM/5P3DOqnYJ6qvfVmPG

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

MsoSync.exe

description pid pid_target process target process

Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 5076 5028 MsoSync.exe WINWORD.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	5076	5028	MsoSync.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEMsoSync.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsoSync.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEMsoSync.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	MsoSync.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	MsoSync.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

5028 WINWORD.EXE
5028 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WINWORD.EXEMsoSync.exe

description pid process

Token: SeAuditPrivilege 5028 WINWORD.EXE
Token: SeAuditPrivilege 5076 MsoSync.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

MsoSync.exe

pid process

5076 MsoSync.exe
5076 MsoSync.exe
5076 MsoSync.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

MsoSync.exe

pid process

5076 MsoSync.exe
5076 MsoSync.exe
5076 MsoSync.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXEMsoSync.exe

pid process

5028 WINWORD.EXE
5028 WINWORD.EXE
5028 WINWORD.EXE
5028 WINWORD.EXE
5028 WINWORD.EXE
5028 WINWORD.EXE
5028 WINWORD.EXE
5028 WINWORD.EXE
5076 MsoSync.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description pid process target process

PID 5028 wrote to memory of 5076 5028 WINWORD.EXE MsoSync.exe
PID 5028 wrote to memory of 5076 5028 WINWORD.EXE MsoSync.exe

pid	process
5028	WINWORD.EXE
5028	WINWORD.EXE

description	pid	process
Token: SeAuditPrivilege	5028	WINWORD.EXE
Token: SeAuditPrivilege	5076	MsoSync.exe

pid	process
5076	MsoSync.exe
5076	MsoSync.exe
5076	MsoSync.exe

pid	process
5076	MsoSync.exe
5076	MsoSync.exe
5076	MsoSync.exe

pid	process
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5028	WINWORD.EXE
5076	MsoSync.exe

description	pid	process	target process
PID 5028 wrote to memory of 5076	5028	WINWORD.EXE	MsoSync.exe
PID 5028 wrote to memory of 5076	5028	WINWORD.EXE	MsoSync.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order-1351125X.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028

C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe
"C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe"
2⤵
- Process spawned unexpected child process
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb
Filesize
512KB

MD5
ad1f632562d809211cc77cbe2005e955

SHA1
19d518b7e55c8ba9e83d73950757bdfb6cc28702

SHA256
1091cae7de87c2010c4cfcd6c36ae7706f017a6f27c741e73a43096f6bd85692

SHA512
373285459e00772d258babfcfcada95422a27518a4503d2120a0226733232755c54141f745c479123f46bf1ae4451357c49fe94b971dc141d84cdead3258c37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb
Filesize
128B

MD5
93613f092b43447e50c65482aaa83cc0

SHA1
cc159612a0a4f7406cb9454beac572821a62e725

SHA256
7af07a3503b5c736e99c982e468b2c42a90b8f8eb990f00ff17f45f76a9ec427

SHA512
193043f2968c2ef0b62427e77306873c20ab270409bf37adc758f4b770d1908584ef9b48f07d0c0804e042a764e4c2ce644935e3ac855d41b264257af35ff023

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/5028-10-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-11-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-5-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5028-34-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-8-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-2-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5028-9-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-35-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-0-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5028-12-0x00007FF81D090000-0x00007FF81D0A0000-memory.dmp

Filesize
64KB

Download
memory/5028-13-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-14-0x00007FF81D090000-0x00007FF81D0A0000-memory.dmp

Filesize
64KB

Download
memory/5028-15-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-17-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-19-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-20-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-18-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-16-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-32-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-33-0x00007FF85FA0D000-0x00007FF85FA0E000-memory.dmp

Filesize
4KB

Download
memory/5028-4-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-6-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5028-7-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-90-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5028-86-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5028-87-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5028-1-0x00007FF85FA0D000-0x00007FF85FA0E000-memory.dmp

Filesize
4KB

Download
memory/5028-3-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-61-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-51-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5076-49-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-48-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5076-57-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5076-50-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5076-62-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-65-0x00007FF85F970000-0x00007FF85FB65000-memory.dmp

Filesize
2.0MB

Download
memory/5076-63-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-64-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-45-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-46-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download
memory/5076-47-0x00007FF81F9F0000-0x00007FF81FA00000-memory.dmp

Filesize
64KB

Download