Analysis

  • max time kernel
    497s
  • max time network
    1577s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/12/2023, 08:11

General

  • Target

    Новая папка/2.60/date/android/USB-Driver C00B101 Virus Scan Report.doc

  • Size

    96KB

  • MD5

    240d4fcfa190220e83a6ff118921be37

  • SHA1

    f6c91bc24d7206795bdab3aac6b1b18d65844bab

  • SHA256

    b58adad961c2529877ba6790e6779536513251238d37484592afb041abde4100

  • SHA512

    5be5f1626d2f1784299bd9e59ea4ad32f2f1fcd3fa7c8b26925568d48b076d3a31e8dec2856354d956192be8c789dba429fae27acb72cff8e0caa67f5470391b

  • SSDEEP

    768:EeoxC1tUOFvkmbd1l9Ek37uvm+oMQxC1tUt2Uw:EW5kwDXDuvm+oMIw

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Новая папка\2.60\date\android\USB-Driver C00B101 Virus Scan Report.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4604

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • memory/4604-11-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-26-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-2-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-4-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-6-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-5-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-7-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-9-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-0-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-21-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-13-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-15-0x00007FFCF6760000-0x00007FFCF6770000-memory.dmp

          Filesize

          64KB

        • memory/4604-14-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-17-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-16-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-18-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-20-0x00007FFD38B80000-0x00007FFD38C2E000-memory.dmp

          Filesize

          696KB

        • memory/4604-23-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-3-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-22-0x00007FFCF6760000-0x00007FFCF6770000-memory.dmp

          Filesize

          64KB

        • memory/4604-12-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-19-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-28-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-31-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-33-0x00007FFD395A0000-0x00007FFD3965F000-memory.dmp

          Filesize

          764KB

        • memory/4604-29-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-1-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-218-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-219-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-220-0x00007FFD395A0000-0x00007FFD3965F000-memory.dmp

          Filesize

          764KB

        • memory/4604-286-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-287-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-288-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-289-0x00007FFCF9B40000-0x00007FFCF9B50000-memory.dmp

          Filesize

          64KB

        • memory/4604-290-0x00007FFD38B80000-0x00007FFD38C2E000-memory.dmp

          Filesize

          696KB

        • memory/4604-292-0x00007FFD38B80000-0x00007FFD38C2E000-memory.dmp

          Filesize

          696KB

        • memory/4604-291-0x00007FFD39AB0000-0x00007FFD39C8B000-memory.dmp

          Filesize

          1.9MB

        • memory/4604-293-0x00007FFD395A0000-0x00007FFD3965F000-memory.dmp

          Filesize

          764KB