Analysis
-
max time kernel
164s -
max time network
242s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13-03-2024 02:15
General
-
Target
malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc
-
Size
333KB
-
MD5
085be1b8b8f3e90be00f6a3bcea2879f
-
SHA1
cc7607015cd7a1a4452acd3d87adabdd7e005bd7
-
SHA256
c4be15f9ccfecf7a463f3b1d4a17e7b4f95de939e057662c3f97b52f7fa3c52f
-
SHA512
9d61f7fcf4543ca2e9d282df93fa604a1736a5a50da47e7c66ecaa635465fef61b26c94af5f6204601668e646b6a140f0e248e01ad79fce056b671a3f6d8c6af
-
SSDEEP
6144:yaZ5a2auBso4RCTS8I7Dh4tkX7rETf1I3pS:35a2bBso6qGf7AT9I3pS
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\malware-sample-library-master\APT28 FancyBear\APT28DecoyDocument.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB