Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 15:04
Static task
static1
Behavioral task
behavioral1
Sample
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc
Resource
win10v2004-20240226-en
General
-
Target
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc
-
Size
292KB
-
MD5
2d243ccd8ff84c25fb9149ebf7766653
-
SHA1
ec2ae69054e3feaeea0cef0e647e3d87d7a7a4d8
-
SHA256
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f
-
SHA512
f7d8f82681f6e79ad2cb225d7bf8e883c147373234ee7436a1344ac40e6db8ef10a59109cfc9b0ca89dd890a5c75e2e61fe0346331db4fc1cce67b6efe2eb99e
-
SSDEEP
6144:iLfhRGxoj8TyvcMkcuGiP7au99jxWbXFLtJu1wp:2fuxom+kcGP2uPABLW+
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1360 WINWORD.EXE 1360 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE 1360 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1360