Overview
overview
10Static
static
8samples (2) (4).zip
windows7-x64
1samples (2) (4).zip
windows10-2004-x64
110d1a82f3c...61.exe
windows7-x64
110d1a82f3c...61.exe
windows10-2004-x64
1133dd26c0a...f0.exe
windows7-x64
10133dd26c0a...f0.exe
windows10-2004-x64
101ab3aad04e...7d.exe
windows7-x64
61ab3aad04e...7d.exe
windows10-2004-x64
11ad4c9e3d0...7d.exe
windows7-x64
11ad4c9e3d0...7d.exe
windows10-2004-x64
127cc1f6adc...35.wsf
windows7-x64
827cc1f6adc...35.wsf
windows10-2004-x64
835b7dbc8a3...31.exe
windows7-x64
935b7dbc8a3...31.exe
windows10-2004-x64
103716dc17e9...c6.dll
windows7-x64
13716dc17e9...c6.dll
windows10-2004-x64
35e94c0f064...2e.exe
windows7-x64
65e94c0f064...2e.exe
windows10-2004-x64
770f166f51e...ad.exe
windows7-x64
170f166f51e...ad.exe
windows10-2004-x64
193dc1dee6b...1a.chm
windows7-x64
1093dc1dee6b...1a.chm
windows10-2004-x64
10a37f77fafa...58.ps1
windows7-x64
1a37f77fafa...58.ps1
windows10-2004-x64
1b875cc39a6...395.js
windows7-x64
8b875cc39a6...395.js
windows10-2004-x64
8b906da71fe...be.exe
windows7-x64
1b906da71fe...be.exe
windows10-2004-x64
1bae7ee765f...c.docm
windows7-x64
1bae7ee765f...c.docm
windows10-2004-x64
1c3fdcec878...07.exe
windows7-x64
4c3fdcec878...07.exe
windows10-2004-x64
4Analysis
-
max time kernel
173s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 15:12
Behavioral task
behavioral1
Sample
samples (2) (4).zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
samples (2) (4).zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
10d1a82f3c458f2a84c28d6b01cab731904f62a1f0a07c3797aadaad05cf4a61.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
10d1a82f3c458f2a84c28d6b01cab731904f62a1f0a07c3797aadaad05cf4a61.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
133dd26c0a6bfbbbe309a845d6f0f382345bdb31595474eb57138ea34c4ddbf0.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
133dd26c0a6bfbbbe309a845d6f0f382345bdb31595474eb57138ea34c4ddbf0.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
1ab3aad04e0eb2c5a15d3e5a576cd3d3e6b1546852ea653cd4369da19a940e7d.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
1ab3aad04e0eb2c5a15d3e5a576cd3d3e6b1546852ea653cd4369da19a940e7d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
1ad4c9e3d0e04e7f1e32e196ea1e87ed64237485baab4cfa4b07eed44d4b347d.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
1ad4c9e3d0e04e7f1e32e196ea1e87ed64237485baab4cfa4b07eed44d4b347d.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
27cc1f6adc3a24ab7dc29c38082e69b0e3993e8a88d91804f88282c240fcac35.wsf
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
27cc1f6adc3a24ab7dc29c38082e69b0e3993e8a88d91804f88282c240fcac35.wsf
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
35b7dbc8a3f456bdafd02383b8a849a6f5fea5f541b3f0c8502e31c2370e8f31.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
35b7dbc8a3f456bdafd02383b8a849a6f5fea5f541b3f0c8502e31c2370e8f31.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
3716dc17e97ffefeeec3508acb79e19beda5d030220c070f62309cafc7a3fac6.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
3716dc17e97ffefeeec3508acb79e19beda5d030220c070f62309cafc7a3fac6.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
5e94c0f064264dffaee5d98e03eaf558c5945475d38162aefc022abc1c4b682e.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
5e94c0f064264dffaee5d98e03eaf558c5945475d38162aefc022abc1c4b682e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
70f166f51e58ef7651a6e567404c71e499d9c2b6e01fc6ae176fd290e91f3aad.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
93dc1dee6b92da2fe38858162e039eb54ce5e109286432cb3a55c06818eff61a.chm
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
93dc1dee6b92da2fe38858162e039eb54ce5e109286432cb3a55c06818eff61a.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
a37f77fafa3df072332dcf2b15d5d91182b3a1a430912e13320cd6148ca8f458.ps1
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
a37f77fafa3df072332dcf2b15d5d91182b3a1a430912e13320cd6148ca8f458.ps1
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
b875cc39a6933b5a96ec292403ea2fa59788658f825b7fd0b66bffc1a6b09395.js
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
b875cc39a6933b5a96ec292403ea2fa59788658f825b7fd0b66bffc1a6b09395.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
b906da71fe22e6e987afe2a70b14aa64cbff3b1049e7779db392b542856452be.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
b906da71fe22e6e987afe2a70b14aa64cbff3b1049e7779db392b542856452be.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac.docm
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac.docm
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
c3fdcec878ac032f4bb4c73a8ba9b08dd546e931d6f0f24bf905207501ba0b07.exe
Resource
win10v2004-20231215-en
General
-
Target
bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac.docm
-
Size
21KB
-
MD5
0a09b1ddda6cf6c1d2e52566986cc379
-
SHA1
2c779063e1393af486c0e81431bbb4e682afd586
-
SHA256
bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac
-
SHA512
35ad11c57050d707d5d46ee6dbd119f9c44993b0c014c9efc5f85bc69fc5251e7d4585cb5acac434e1cdf63b99f57dcbc00c43b671c2b68a41b987ccee36b606
-
SSDEEP
384:CTeEJwk57y4uCo4wB2Z1xG7tlBcxXw6besz2h:3Ohy7UZbKlBcxA6beszG
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1192 WINWORD.EXE 1192 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bae7ee765f1ec70ca4a9a734abecca822860c67ed6b42f8bab49ab2b34808eac.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1192