Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/03/2024, 21:49
General
- Target adjure.04.30.2021.docm
- Size 76KB
- Sample240313-1pjelsaa61
- SHA256 b3dbdf013c494dc354374a50e95635d53d2dabfc59527a17a5f104e8deb07554
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\adjure.04.30.2021.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Word.CampaignStates.json
Word.GovernedChannelStates.json
Word.Settings.json
Word.SurveyEventActivityStats.json
winword.exe.db-wal
winword.exe.db-wal
089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
memory/2944-8-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-35-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-7-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-105-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-9-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-10-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-11-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-12-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-13-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-14-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-16-0x00007FFA932C0000-0x00007FFA932D0000-memory.dmp
memory/2944-17-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-18-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-15-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-19-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-20-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-21-0x00007FFA932C0000-0x00007FFA932D0000-memory.dmp
memory/2944-26-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-28-0x0000015763F40000-0x0000015764140000-memory.dmp
memory/2944-4-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/2944-38-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-61-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-99-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-148-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-149-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-6-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/2944-5-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-3-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/2944-2-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/2944-1-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/2944-0-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/2944-117-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-116-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-115-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-114-0x0000015763F40000-0x0000015764140000-memory.dmp
memory/2944-113-0x0000015762D90000-0x0000015763D60000-memory.dmp
memory/2944-112-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-45-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-60-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-76-0x0000022D5DDA0000-0x0000022D5E5A0000-memory.dmp
memory/4548-82-0x0000022D5DDA0000-0x0000022D5E5A0000-memory.dmp
memory/4548-103-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/4548-104-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/4548-102-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/4548-101-0x00007FFA955B0000-0x00007FFA955C0000-memory.dmp
memory/4548-59-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-106-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-55-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-54-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-53-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-51-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-50-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-49-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-48-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-44-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-46-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-47-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-40-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-42-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp
memory/4548-41-0x00007FFAD5530000-0x00007FFAD5725000-memory.dmp