Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/03/2024, 00:14
General
-
Target
bd2b67ae971c12153c1ddb9b4b56cb13.doc
-
Size
1.2MB
-
MD5
bd2b67ae971c12153c1ddb9b4b56cb13
-
SHA1
de4d5b15b46515cd443de6b2da13a622eacc7717
-
SHA256
6e1294fe6e79260fb4c529e3482bec63d3606c99cd02fa8067b31940a682c8e4
-
SHA512
cc40c746d53e072bf54bf75c9ffbcdf701f672e74c99aa97fa437c7506801286c75af8ec55ba423b9c4c9271077ef3e2dfbdc01350e5a82728d49b525eb9cf04
-
SSDEEP
24576:kg17/ZUMCAoMbSLRv+aD+h4nzP0BD+pzPIVH28vBJZ4jlGbx6Sv8mI8://ZsANSLoXwD08pTiH5GjUbxjvnN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bd2b67ae971c12153c1ddb9b4b56cb13.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB