Analysis
-
max time kernel
127s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2023 16:20
Static task
static1
Behavioral task
behavioral1
Sample
aee43496026aadd3bb0884c7fcd200758fde8c35940f0745628f4a0f480923c0_JC.rtf
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
aee43496026aadd3bb0884c7fcd200758fde8c35940f0745628f4a0f480923c0_JC.rtf
Resource
win10v2004-20230915-en
General
-
Target
aee43496026aadd3bb0884c7fcd200758fde8c35940f0745628f4a0f480923c0_JC.rtf
-
Size
92KB
-
MD5
87dc64cd0d2d13f4897619c008540bcb
-
SHA1
7f191350095893ebc3e1aa0e9e79dc083961e697
-
SHA256
aee43496026aadd3bb0884c7fcd200758fde8c35940f0745628f4a0f480923c0
-
SHA512
09e5d4f84ee2da4306cd4ddc97bebec6071b075e236ef861149daf30ae156d7e0b6f6882926eb7e0f841988424e07d283f505d9de4d91955e1f305961b05b755
-
SSDEEP
768:ewAbZSibMX9gRWjFrOxpo0gcdOSY04ttpVtocQWILLIYGYsTqcmtDU9YHL:ewAlRQKxmidnY04ttpXoeyhGYsVmtYUL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1060 WINWORD.EXE 1060 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\aee43496026aadd3bb0884c7fcd200758fde8c35940f0745628f4a0f480923c0_JC.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-1-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-0-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-2-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-4-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-5-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-3-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-7-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-6-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-8-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-9-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-10-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-12-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-11-0x00007FFE21B90000-0x00007FFE21BA0000-memory.dmpFilesize
64KB
-
memory/1060-13-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-14-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-15-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-16-0x00007FFE21B90000-0x00007FFE21BA0000-memory.dmpFilesize
64KB
-
memory/1060-18-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-19-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-17-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-20-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-21-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-22-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-26-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-27-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-28-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-29-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-52-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-53-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-56-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-55-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-54-0x00007FFE24250000-0x00007FFE24260000-memory.dmpFilesize
64KB
-
memory/1060-57-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-58-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB
-
memory/1060-59-0x00007FFE641D0000-0x00007FFE643C5000-memory.dmpFilesize
2.0MB