Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2023, 12:21

General

  • Target

    Order PSL-6726 CGF0629.rtf

  • Size

    73KB

  • MD5

    ed87cf43c4a1bd2623e19f5138e6debc

  • SHA1

    67671e0a3697ce7c72c52fe493241bebfbe86bc4

  • SHA256

    974dd7a8b2afaabc593b3e8f88bf19f52a742ca7b5c2f02f97125cdefba1b444

  • SHA512

    1ea604c8f58204522fe5bd2184207d86671f6a2740413361ae0f7698de9ba5ccc726ff81740d62c60d7ea41910d3776eb65c04e01dae400878a81de491127d92

  • SSDEEP

    1536:I54pe+DwbMndXB/mmG4YgNU7K2w+r3TZpanJcSMsdDGatnQy8uvNQ13mQwADA2rr:IqpeEwodR/mayNp3sdDjwvr

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order PSL-6726 CGF0629.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3500

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3500-133-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-134-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-135-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-136-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-137-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-138-0x00007FFA99290000-0x00007FFA992A0000-memory.dmp

    Filesize

    64KB

  • memory/3500-139-0x00007FFA99290000-0x00007FFA992A0000-memory.dmp

    Filesize

    64KB

  • memory/3500-170-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-171-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-172-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB

  • memory/3500-173-0x00007FFA9BA30000-0x00007FFA9BA40000-memory.dmp

    Filesize

    64KB