Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2023 13:44

General

  • Target

    Project.rtf

  • Size

    148KB

  • MD5

    55c518c611f0db3817822960fb83be24

  • SHA1

    a1e7a4496f0db72cc4d67fceef9bed01deff9bf0

  • SHA256

    8c18c0514255595dda708a1fe487076ed15eac9237f39f965baee9f2924003ba

  • SHA512

    43934f581fb941b23252e979465e68f42a034a4f441d0ed264b4629134c4c4245c683d980d3013f69f3801a3cc382a62cc7826ac90916234f047184b04401d4a

  • SSDEEP

    768:dwAbZSibMX9gRWjwNWgH5ufgZ1qXPH/53wYUbX6vv6ea++A30PN:dwAlR9DXZgHBzUz6vv6ea+cPN

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Project.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3056-1-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-0-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-2-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-3-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-5-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-6-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-8-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-7-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-4-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-9-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-10-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-11-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-12-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-14-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-13-0x00007FF840FA0000-0x00007FF840FB0000-memory.dmp

    Filesize

    64KB

  • memory/3056-15-0x00007FF840FA0000-0x00007FF840FB0000-memory.dmp

    Filesize

    64KB

  • memory/3056-17-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-18-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-19-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-20-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-16-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-31-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-32-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-33-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-34-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-57-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-58-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-60-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-61-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-62-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-59-0x00007FF8436D0000-0x00007FF8436E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-63-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB

  • memory/3056-64-0x00007FF883650000-0x00007FF883845000-memory.dmp

    Filesize

    2.0MB