Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2023 07:15

General

  • Target

    50a7ad2ace11903c9d16a6c8660631de.rtf

  • Size

    42KB

  • MD5

    50a7ad2ace11903c9d16a6c8660631de

  • SHA1

    d67e713c65195405dd9a97034d15c7d8fa3b37bb

  • SHA256

    34d0f98cec02e36273e2e3fadfc535875acf7df8dc8e68b5a9b10ab74300cde9

  • SHA512

    be37c692d197263b425745077c743b91e2dd90fa1e2ac531b8d00d904012df52928d5638733de1be2556dc78ab01b2dbd2020d9e36c4281c67f46068bdff3fd0

  • SSDEEP

    768:MFx0XaIsnPRIa4fwJMAUZCdpcWyxGPnSCX4gApJ43XvtcB62anYp:Mf0Xvx3EMAUCTcWyxGPdvnvtcBHanYp

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\50a7ad2ace11903c9d16a6c8660631de.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4804-134-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-133-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-135-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-137-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-138-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-140-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-139-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-136-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-141-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-142-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-143-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-144-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-145-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-146-0x00007FF820330000-0x00007FF820340000-memory.dmp

    Filesize

    64KB

  • memory/4804-147-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-148-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-149-0x00007FF820330000-0x00007FF820340000-memory.dmp

    Filesize

    64KB

  • memory/4804-153-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-154-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-155-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-183-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-184-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-185-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-186-0x00007FF822910000-0x00007FF822920000-memory.dmp

    Filesize

    64KB

  • memory/4804-187-0x00007FF862890000-0x00007FF862A85000-memory.dmp

    Filesize

    2.0MB