Analysis
-
max time kernel
146s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 14:43
Static task
static1
Behavioral task
behavioral1
Sample
بررسی رابطه بین سبک های تفکر، باورهای غیر منطقی و شیوه �.doc
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
بررسی رابطه بین سبک های تفکر، باورهای غیر منطقی و شیوه �.doc
Resource
win10v2004-20231020-en
General
-
Target
بررسی رابطه بین سبک های تفکر، باورهای غیر منطقی و شیوه �.doc
-
Size
2.4MB
-
MD5
cf54b38c5ac4eb39ec7e60c9d0a61e7a
-
SHA1
0d906c82ae4e1f5eefdf61baebc5fa9a4c92078f
-
SHA256
ea8008dcbef93b83954f001ceb518b89ac2b6121bd235291ad3236ea4a4e9c53
-
SHA512
53605cc836e3c599174e0d38d0e65009aa5889696cd2b709e79f792f04be9432548b548bbbfe3ce31ad466dd0f02eada631d41e925f9f5ff9d8917853db4115e
-
SSDEEP
24576:/gUkMbhMnLIQvAYqgbEzd00opAi3KRcl6NyvxEogZ:RenL7A3
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 384 WINWORD.EXE 384 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE 384 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\بررسی رابطه بین سبک های تفکر، باورهای غیر منطقی و شیوه �.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
963KB
MD53694c55d7c92de94f383ad9dcb8388d3
SHA115b92005e71434bd3c59bb662dd1d69c847ffbe7
SHA25660c46eb0c88805488dd3a7336da5f1b910bb007efb2d2d8c3207a798fe2b2753
SHA512beb24bfb97252b74abf33993b022a43e7883171bc1f43e6ad8c4cfe7692a2a7e10fde266d65817f703dce0a4832caf84103c7ced8bbefb9c30f33e222cd751ba
-
Filesize
963KB
MD516d4390cd01e5983480c998eb08667b9
SHA1529ff8cf4d8b9098e7e5ef19c477cea2942bc8f0
SHA256fe266d5c72e2fc92c86095b6551e01ff4bb8d1314dad623340b9e04f4a6b7380
SHA5128408f7ba55498ebd3c52c08cf09f12781e448cce458ed30cabfe4eb37d298848b739e05533e64da0b29d050f543d5e44c32fc75fca3bfe267e1ec8277ff4dd5e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84