Analysis

  • max time kernel
    173s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2024 15:12

General

  • Target

    bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac.docm

  • Size

    21KB

  • MD5

    0a09b1ddda6cf6c1d2e52566986cc379

  • SHA1

    2c779063e1393af486c0e81431bbb4e682afd586

  • SHA256

    bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac

  • SHA512

    35ad11c57050d707d5d46ee6dbd119f9c44993b0c014c9efc5f85bc69fc5251e7d4585cb5acac434e1cdf63b99f57dcbc00c43b671c2b68a41b987ccee36b606

  • SSDEEP

    384:CTeEJwk57y4uCo4wB2Z1xG7tlBcxXw6besz2h:3Ohy7UZbKlBcxA6beszG

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac.docm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1192-0-0x00007FF9A2F70000-0x00007FF9A2F80000-memory.dmp

    Filesize

    64KB

  • memory/1192-1-0x00007FF9A2F70000-0x00007FF9A2F80000-memory.dmp

    Filesize

    64KB

  • memory/1192-4-0x00007FF9A2F70000-0x00007FF9A2F80000-memory.dmp

    Filesize

    64KB

  • memory/1192-5-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-3-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-6-0x00007FF9A2F70000-0x00007FF9A2F80000-memory.dmp

    Filesize

    64KB

  • memory/1192-7-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-2-0x00007FF9A2F70000-0x00007FF9A2F80000-memory.dmp

    Filesize

    64KB

  • memory/1192-8-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-9-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-10-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-11-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-12-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-13-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-14-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-15-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-16-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-18-0x00007FF9A0EC0000-0x00007FF9A0ED0000-memory.dmp

    Filesize

    64KB

  • memory/1192-19-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-17-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-20-0x00007FF9A0EC0000-0x00007FF9A0ED0000-memory.dmp

    Filesize

    64KB

  • memory/1192-38-0x000001FDF0A30000-0x000001FDF1A00000-memory.dmp

    Filesize

    15.8MB

  • memory/1192-49-0x000001FDF0A30000-0x000001FDF1A00000-memory.dmp

    Filesize

    15.8MB

  • memory/1192-50-0x000001FDF0A30000-0x000001FDF1A00000-memory.dmp

    Filesize

    15.8MB

  • memory/1192-51-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-52-0x00007FF9E2EF0000-0x00007FF9E30E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1192-53-0x000001FDF0A30000-0x000001FDF1A00000-memory.dmp

    Filesize

    15.8MB

  • memory/1192-57-0x000001FDF0A30000-0x000001FDF1A00000-memory.dmp

    Filesize

    15.8MB

  • memory/1192-60-0x000001FDF0A30000-0x000001FDF1A00000-memory.dmp

    Filesize

    15.8MB