Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 13:59

General

  • Target

    $PLUGINSDIR/license_Claro_OU_2.rtf

  • Size

    32KB

  • MD5

    7b5d720492bf145241e95b563d4f3341

  • SHA1

    693b1d6a56b6b24bcedddda60c4612ac7ea1a6d1

  • SHA256

    87ddcd8980f04ba867b4c0af427ccba822412f1fad5ea8718f947e9de5950d6c

  • SHA512

    91df22c42143c47b7f53cc56efc4aed4492ff2753213a91f95e042a0e504cfea365141f1416588a65d93a92adaa92eccc0ce789d63620a54b4380e29e8d03a7f

  • SSDEEP

    384:VNXtDNVb7PzybdKkjEGGYgUQxirFyh27i6rGsNAYAXJqskGC:VNX6EGqnyhAZqCC

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_Claro_OU_2.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1608-0-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-1-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-3-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-2-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-6-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-5-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-4-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-7-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-8-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-9-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-10-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-11-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-12-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-13-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-15-0x00007FF883850000-0x00007FF883860000-memory.dmp

    Filesize

    64KB

  • memory/1608-14-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-16-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-17-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-18-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-19-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-20-0x00007FF883850000-0x00007FF883860000-memory.dmp

    Filesize

    64KB

  • memory/1608-34-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-35-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-36-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-37-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-58-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-59-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-61-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-62-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-60-0x00007FF885DB0000-0x00007FF885DC0000-memory.dmp

    Filesize

    64KB

  • memory/1608-63-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB

  • memory/1608-64-0x00007FF8C5D30000-0x00007FF8C5F25000-memory.dmp

    Filesize

    2.0MB