Analysis
-
max time kernel
142s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 10:49
General
-
Target
OfficeSetup.exe
-
Size
8.0MB
-
MD5
a00cc587fc5b60da836fae6f57e37215
-
SHA1
9f0f130231be528d9e1815f8fbde59d498d6af4b
-
SHA256
f52a9ae7036a7e113d4ad84816694f9b713a9f1d82b279a126b295c9fa1d480b
-
SHA512
988a87ab8466e6a951da4486ea5426f33f2679993c4654de591c55f5ec18b358ed8b56778f910302cf3073c8ab77fa1eb8465f2a81279626f4868dccd72c0a34
-
SSDEEP
196608:+Fhx3li/KRXxG2nZ000UMVZUMPRcmLup5+g/TpxI81Heyf:2i/QxGAZ0FVZUILup5fpx3Heyf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 10 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 6 IoCs
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 5 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 12 IoCs
-
Modifies data under HKEY_USERS 40 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"1⤵
- Checks computer location settings
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=es-es productstoadd=O365ProPlusRetail.16_es-es_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl=http://officecdn.microsoft.com/db/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.16827.20166 mediatype=CDN sourcetype=CDN O365ProPlusRetail.excludedapps=groove updatesenabled=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True scenario=CLIENTUPDATE2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exeOfficeClickToRun.exe platform=x64 culture=es-es productstoadd=O365ProPlusRetail.16_es-es_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 baseurl.16=http://officecdn.microsoft.com/db/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version.16=16.0.16827.20166 mediatype.16=CDN sourcetype.16=CDN O365ProPlusRetail.excludedapps.16=groove updatesenabled.16=False bitnessmigration=False deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
531KB
MD5c66926bfecc9c8a1df9e2f1e17070661
SHA1a6335dd5a0e62621b32c4a2d26c7b8a592d51ca6
SHA25625d70018e8cda903759499599fd4cd015058966205f254e1a6660c72bc3e9cd0
SHA51219a215b12f7eb2a5ffdcc43bdf58310be665a1e3f42d316f649047bb6ec8b6700a04288211b793e965514fa5f6785eb10a8cdd7cde9466d6362db0ef55206b4e
-
Filesize
1.0MB
MD5c9f1a48e9594a1e00a754d0bf50fa6cd
SHA1c07ac2f5d10c007e33a76261dd4b9f5a7ca9a67e
SHA256b9ce70c3b1a73efe80753a05d93d1f84d43456095e1f72358a7cc5c48444d0b3
SHA5123a1edfdce7884558a9ad728e897ef0b3268c18f68b79441fe6eaa4505cbb9ba757b9907ece46781d09e57e32c949e64c973e4ac848bfe9b88c53777e0c05bbff
-
Filesize
309KB
MD522a0056ffd1c0b3081ca56f441cec3c9
SHA181eaaed525b7c714261f840f7cdb5164e45d734e
SHA256782910b23f8a65ec477f886f7bcbdc67103354af263bd30c0dccabbfbc506ba1
SHA51272cc4c4625555fd2fb2276a0a062d39ff2ac7b55a212ce6f58fbd7f58ca5a4a0d69e43a7b72bdafa803c84bc400afb5c274e455e5846c83d35d3f9bce88be41b
-
Filesize
557KB
MD57db24201efea565d930b7ec3306f4308
SHA1880c8034b1655597d0eebe056719a6f79b60e03c
SHA25672fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e
SHA512bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
37KB
MD575e78e4bf561031d39f86143753400ff
SHA1324c2a99e39f8992459495182677e91656a05206
SHA2561758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
-
Filesize
106B
MD5d040fdc85462b75fd70a4b1b774b73a7
SHA1ec68c13e5de7c339178341def04034c12cbed8c4
SHA256235b4abf4be53f959bba1cc535904c3c38999b465d34b912cb6c03e0a982fd1e
SHA51220e9646aa701dc9c144b9a05b0618e9d93e1fda0db6b5f73d027b0acc64838c2461e64bb08f22db09d96546d373aba16a993f97a254ffa8c1ccf7c16654093b9
-
Filesize
531KB
MD5c66926bfecc9c8a1df9e2f1e17070661
SHA1a6335dd5a0e62621b32c4a2d26c7b8a592d51ca6
SHA25625d70018e8cda903759499599fd4cd015058966205f254e1a6660c72bc3e9cd0
SHA51219a215b12f7eb2a5ffdcc43bdf58310be665a1e3f42d316f649047bb6ec8b6700a04288211b793e965514fa5f6785eb10a8cdd7cde9466d6362db0ef55206b4e
-
Filesize
531KB
MD5c66926bfecc9c8a1df9e2f1e17070661
SHA1a6335dd5a0e62621b32c4a2d26c7b8a592d51ca6
SHA25625d70018e8cda903759499599fd4cd015058966205f254e1a6660c72bc3e9cd0
SHA51219a215b12f7eb2a5ffdcc43bdf58310be665a1e3f42d316f649047bb6ec8b6700a04288211b793e965514fa5f6785eb10a8cdd7cde9466d6362db0ef55206b4e
-
Filesize
12.3MB
MD546ac7afc8a824aa0ddb5a7c65a850c37
SHA107a7a4ac55f3d69e69094f3b08ce730cf8606830
SHA256f2e513184e7d4c37feff856cf75d8f1dc098069dde91fa0fdfd777e6ebb119f9
SHA512b27414607170f69aef4039858675d634db292770e44bf3fa7020c14c5cf79254d0a2841751c5e0a4bc489ca7ba506515d035fca71ec8bac912f72a42bba8f30d
-
Filesize
12.3MB
MD546ac7afc8a824aa0ddb5a7c65a850c37
SHA107a7a4ac55f3d69e69094f3b08ce730cf8606830
SHA256f2e513184e7d4c37feff856cf75d8f1dc098069dde91fa0fdfd777e6ebb119f9
SHA512b27414607170f69aef4039858675d634db292770e44bf3fa7020c14c5cf79254d0a2841751c5e0a4bc489ca7ba506515d035fca71ec8bac912f72a42bba8f30d
-
Filesize
106B
MD5d040fdc85462b75fd70a4b1b774b73a7
SHA1ec68c13e5de7c339178341def04034c12cbed8c4
SHA256235b4abf4be53f959bba1cc535904c3c38999b465d34b912cb6c03e0a982fd1e
SHA51220e9646aa701dc9c144b9a05b0618e9d93e1fda0db6b5f73d027b0acc64838c2461e64bb08f22db09d96546d373aba16a993f97a254ffa8c1ccf7c16654093b9
-
Filesize
309KB
MD522a0056ffd1c0b3081ca56f441cec3c9
SHA181eaaed525b7c714261f840f7cdb5164e45d734e
SHA256782910b23f8a65ec477f886f7bcbdc67103354af263bd30c0dccabbfbc506ba1
SHA51272cc4c4625555fd2fb2276a0a062d39ff2ac7b55a212ce6f58fbd7f58ca5a4a0d69e43a7b72bdafa803c84bc400afb5c274e455e5846c83d35d3f9bce88be41b
-
Filesize
309KB
MD522a0056ffd1c0b3081ca56f441cec3c9
SHA181eaaed525b7c714261f840f7cdb5164e45d734e
SHA256782910b23f8a65ec477f886f7bcbdc67103354af263bd30c0dccabbfbc506ba1
SHA51272cc4c4625555fd2fb2276a0a062d39ff2ac7b55a212ce6f58fbd7f58ca5a4a0d69e43a7b72bdafa803c84bc400afb5c274e455e5846c83d35d3f9bce88be41b
-
Filesize
31KB
MD54acd310bdf5b542685f481220db2d082
SHA1ac05f217263674ab1b8558ba552b8a2e53b3dc44
SHA256a0790a86b22cab6a915b9add19457f58e450f955c9da6ff7caa48623af402d2d
SHA51299edd2608feb5d5335459b2de03087fd276d94a91b112da1e72698a2cac7db115bebfb6237a45f1f51a1e8b11d6d34734190f6eb301fbf9936517407f92730d9
-
Filesize
557KB
MD57db24201efea565d930b7ec3306f4308
SHA1880c8034b1655597d0eebe056719a6f79b60e03c
SHA25672fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e
SHA512bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e
-
Filesize
557KB
MD57db24201efea565d930b7ec3306f4308
SHA1880c8034b1655597d0eebe056719a6f79b60e03c
SHA25672fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e
SHA512bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
37KB
MD575e78e4bf561031d39f86143753400ff
SHA1324c2a99e39f8992459495182677e91656a05206
SHA2561758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
-
Filesize
37KB
MD575e78e4bf561031d39f86143753400ff
SHA1324c2a99e39f8992459495182677e91656a05206
SHA2561758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756
-
Filesize
471B
MD51b71e8b9709421c76b340f97307e4672
SHA10a8552efbc748a916f6ab1186fda4486a2092a28
SHA2560cbd195bb0107f6c0019756a0bb2c1c40cc5008472b6b1ee37e38f8bb4ca2fc5
SHA512668fb7e73580e47fd8a75ed81b15f79944a728d658acad474a431d73e5c2f762881dbf0568e10f129ca7ee3658a3112dc3a79be61726f5d39254985b41e57c00
-
Filesize
412B
MD50676b6f32c23d163ef119797b97e2f1b
SHA10662a2742f951c7bd9debbcd8025a5ebc0725231
SHA2563f3f4a31dd49e80bbb34c9aa80273b347ecdba2fb887fa3a0f8aba4929f8a74e
SHA51209ae53dd67b363fe43a78c9e115c9245e72eaf5f6c3179999a6f912576d42de950443b2cc5a21fef3972eed1515c24568379b3527a07aeab488971206f8aea96
-
Filesize
24KB
MD58665de22b67e46648a5a147c1ed296ca
SHA1b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA256b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
SHA512bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
-
Filesize
31.2MB
MD5d92f92e645eac2e51f05a6d002e7284f
SHA14754c3664e49305a15663e9c4c3cf1162a363af3
SHA256a860b4f66110c3ef4713fcb4266aa582ad2766c389518fe80d1a717c047c846e
SHA5129a3033662c52ff393d1e8d1419369350222a7282de4407ff4970e4096c4c478c55cc1acceec7d5764f01cf23f200e21c8ad890d8f2d7f11e4de57b0ca807259e
-
Filesize
26B
MD5bd3457e50947d4280734e74b51b5b68d
SHA1424635c6b5622a6c01a59d290a1c9ab8e593effc
SHA25623d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5
SHA512e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb
-
Filesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
Filesize
20KB
MD538cbb8a561c37a1a37902967cab426ea
SHA18ce8ff662e835dab294ad6f3e11d541944a60f20
SHA2563196f007b0450f9f2b4b82f61603cade2eaa646c9559a7091e62d9391d02ffc5
SHA5127ccb0cf35c1df48ec2f7550c2dc65b7c2940230e492da4cee7c4ba4d3bb96f952bcea151109a50f91c85a4d9e206e25df223451682a6b65b7fd4c153c1367f93
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
232KB
-
Filesize
620KB
-
Filesize
84KB
-
Filesize
10.6MB