Overview
overview
10Static
static
1Victoria537.zip
windows7-x64
Victoria537.zip
windows10-2004-x64
1Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
1Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
10Victoria53...mo.rtf
windows7-x64
4Victoria53...mo.rtf
windows10-2004-x64
1Victoria53...lp.rtf
windows7-x64
4Victoria53...lp.rtf
windows10-2004-x64
1Victoria53...ew.rtf
windows7-x64
4Victoria53...ew.rtf
windows10-2004-x64
1Victoria53...sh.lng
windows7-x64
3Victoria53...sh.lng
windows10-2004-x64
3Victoria53...ol.lng
windows7-x64
3Victoria53...ol.lng
windows10-2004-x64
3Victoria53...ne.lng
windows7-x64
3Victoria53...ne.lng
windows10-2004-x64
3Victoria53...й.lng
windows7-x64
3Victoria53...й.lng
windows10-2004-x64
3Victoria53...st.rtf
windows7-x64
4Victoria53...st.rtf
windows10-2004-x64
1Victoria53...ia.exe
windows7-x64
6Victoria53...ia.exe
windows10-2004-x64
6Analysis
-
max time kernel
234s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
27-03-2023 16:15
Static task
static1
Behavioral task
behavioral1
Sample
Victoria537.zip
Resource
win7-20230220-es
Behavioral task
behavioral2
Sample
Victoria537.zip
Resource
win10v2004-20230220-es
Behavioral task
behavioral3
Sample
Victoria537/Help/English/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral4
Sample
Victoria537/Help/English/dcomemo.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral5
Sample
Victoria537/Help/English/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral6
Sample
Victoria537/Help/English/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral7
Sample
Victoria537/Help/English/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral8
Sample
Victoria537/Help/English/whatsnew.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral9
Sample
Victoria537/Help/Ukraine/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral10
Sample
Victoria537/Help/Ukraine/dcomemo.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral11
Sample
Victoria537/Help/Ukraine/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral12
Sample
Victoria537/Help/Ukraine/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral13
Sample
Victoria537/Help/Ukraine/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral14
Sample
Victoria537/Help/Ukraine/whatsnew.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral15
Sample
Victoria537/Help/Русский/dcomemo.rtf
Resource
win7-20230220-es
Behavioral task
behavioral16
Sample
Victoria537/Help/Русский/dcomemo.rtf
Resource
win10v2004-20230221-es
Behavioral task
behavioral17
Sample
Victoria537/Help/Русский/vichlp.rtf
Resource
win7-20230220-es
Behavioral task
behavioral18
Sample
Victoria537/Help/Русский/vichlp.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral19
Sample
Victoria537/Help/Русский/whatsnew.rtf
Resource
win7-20230220-es
Behavioral task
behavioral20
Sample
Victoria537/Help/Русский/whatsnew.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral21
Sample
Victoria537/LNG/English.lng
Resource
win7-20230220-es
Behavioral task
behavioral22
Sample
Victoria537/LNG/English.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral23
Sample
Victoria537/LNG/Español.lng
Resource
win7-20230220-es
Behavioral task
behavioral24
Sample
Victoria537/LNG/Español.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral25
Sample
Victoria537/LNG/Ukraine.lng
Resource
win7-20230220-es
Behavioral task
behavioral26
Sample
Victoria537/LNG/Ukraine.lng
Resource
win10v2004-20230220-es
Behavioral task
behavioral27
Sample
Victoria537/LNG/Русский.lng
Resource
win7-20230220-es
Behavioral task
behavioral28
Sample
Victoria537/LNG/Русский.lng
Resource
win10v2004-20230221-es
Behavioral task
behavioral29
Sample
Victoria537/USB_SupportList.rtf
Resource
win7-20230220-es
Behavioral task
behavioral30
Sample
Victoria537/USB_SupportList.rtf
Resource
win10v2004-20230220-es
Behavioral task
behavioral31
Sample
Victoria537/Victoria.exe
Resource
win7-20230220-es
Behavioral task
behavioral32
Sample
Victoria537/Victoria.exe
Resource
win10v2004-20230220-es
General
-
Target
Victoria537/USB_SupportList.rtf
-
Size
10KB
-
MD5
f566493c6cb084ef1360d58cf36d441d
-
SHA1
3f9948445663723eb707fd45144fea4e13ab1434
-
SHA256
43f3560e21418001b6aa5f319e6431d8310692899437727fe099fe580b1afeff
-
SHA512
2c1dca1a527d69013088062e3dbd3333ad62e1e367bdccdb6f036f8fac5b784398e19023b1b9aed68ea6c6779a65004658cc5588ab9a61c75d2bf0035e6d431c
-
SSDEEP
192:zVQ6UTi4ygQbjVfNYepa3t+qyDmN8qMGxwD9KwS8kXcFmDfpylp0ETmlojyHcPeL:6e4y16eG+q29ZS8sTp6xT2YLEmkOD2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1084 WINWORD.EXE 1084 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Victoria537\USB_SupportList.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1084-133-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-134-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-135-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-136-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-137-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-138-0x00007FF955CF0000-0x00007FF955D00000-memory.dmpFilesize
64KB
-
memory/1084-139-0x00007FF955CF0000-0x00007FF955D00000-memory.dmpFilesize
64KB
-
memory/1084-168-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-169-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-170-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB
-
memory/1084-171-0x00007FF957E30000-0x00007FF957E40000-memory.dmpFilesize
64KB