Analysis
-
max time kernel
363s -
max time network
864s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
-
submitted
16-10-2023 02:42
General
-
Target
tragedy_redux.zip
-
Size
23KB
-
MD5
3abfa64598fb01ce7130bab6f24d4ea8
-
SHA1
a1d8f1e0613286f279506a1fbd1bdb75c2f27ecc
-
SHA256
f03e0df31b16d4dd954918c496a24107c69a6468be1f2703fe56ef1f91118e47
-
SHA512
94340fbf262d32177c94f39ca4e1985b457508ae80ea361341640f1d396f883d65a31b220966ee86a111dd14b79076dfabf3e9967cfa9aa74597439c875489ea
-
SSDEEP
384:NiLBYSEK0YBM2oK1KUs1IdXJCtmqpwcdSDat2aEkRmhudj/hv/6iMLPj4:NkBYDYM27A8XJC8qpwcdSet0up/ZSiMQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 32 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 45 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\tragedy_redux.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\Documents\tragedy_redux\word\vbaProject.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\tragedy_redux\word\vbaProject.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\tragedy_redux\word\vbaProject.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5d9237b8b033fd1c3c31a29c2bdc39e2e
SHA1993ae82f5e073925d34ebc3ff08e13574dd78ee2
SHA256d853a063cb2a8a92618444d430446d638a40f26b7396c6569a0fa03ca5de0142
SHA5123de8122bb72344d0b702c3ba059b15faddd6942d4d1384832b41ebb4d6a8e0f8c5cf3d544ce08c28729c17dfe9785e5a665b1c869e8346ba3c47aad5597e6b4c
-
Filesize
257B
MD5a20974efcd0633f30f01ad6f60a8efcb
SHA1ee8a09b2198f6992d0c6a1e087cad6aed3fb7d69
SHA256b44920516bb9518954d493279c40cba2752bacaa60e1b5193a22d48f13b76dde
SHA512fc423127127a43c8bafa79c15223ffff2e0a9ae2d02974b6b9566ef041ec973357f01d5e87cdbce59744c662a95c305bc6266b8008752a02228fa0196ab14f88
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
64KB