Resubmissions

16/03/2023, 02:26

230316-cxcp2aag91 10

15/03/2023, 21:37

230315-1gp77ahf5v 10

15/03/2023, 21:32

230315-1dtffafd59 4

Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 21:32

General

  • Target

    8846_0.one

  • Size

    117KB

  • MD5

    b4d388fd8748c7a725541d8a53151a51

  • SHA1

    dc348918f86f3f96b8a508d9ab18788d20ae97d5

  • SHA256

    5697f2ac10e6f1a82497b6b8b19df905f77980ed0644ccd93d2e7bdbfd912241

  • SHA512

    410ab97d0d0fded07650287e4cc66eb9f54fa91ea1c0a8a1de57a723a11ae340de917549b85e7cd951249b58cf6aa213dc9f87e0af9f2dcf56e96abe1eb29439

  • SSDEEP

    1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXI:1BoC+tCYvSMVnte8ZP1Y6JY

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\8846_0.one"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4148

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.bin

    Filesize

    53KB

    MD5

    ae25f2104967b2708ac9dba80aac52fd

    SHA1

    7ac0150b43cbb5eeba9a0f956e1291df6790f3bf

    SHA256

    11b3d1564b12934489281250c9a683f076fe10254bfdd7da72307e538838ec56

    SHA512

    d4a7f95631e7eb88fdadbe66d31bf9c7459d0f80ca2c9174952aad42bff6262241b25916e6a089f778990be981a2cf220baa69ad261314247c286397553decca

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.bin

    Filesize

    567B

    MD5

    d055ce625528e448c61315eaaef5bb71

    SHA1

    029df4c872b1c154f32e7fe94f434547c3ba6192

    SHA256

    85bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705

    SHA512

    705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.bin

    Filesize

    48KB

    MD5

    b7fc313714edd7866f4c76527282c2b5

    SHA1

    c86217b46956933fae4a30483a63b33f34b8c503

    SHA256

    b6d25f5eb52d5c24ef6c325bd25f18e413f3e23d20413a3693749275ba4b192c

    SHA512

    038a73b7a69dd976c964f1538f5b4f7c6c64721e4f2f1a831815598faae84cac53305c03f5cea6e66acdc110a9a5117eee191345ea004b9576c752122f8d88f7

  • memory/4148-133-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

    Filesize

    64KB

  • memory/4148-134-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

    Filesize

    64KB

  • memory/4148-135-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

    Filesize

    64KB

  • memory/4148-136-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

    Filesize

    64KB

  • memory/4148-137-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

    Filesize

    64KB

  • memory/4148-138-0x00007FF995E50000-0x00007FF995E60000-memory.dmp

    Filesize

    64KB

  • memory/4148-139-0x00007FF995E50000-0x00007FF995E60000-memory.dmp

    Filesize

    64KB