Analysis

  • max time kernel
    172s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 09:44

General

  • Target

    e07b53986c5ca16253418fc2782bf12e834f1292fab71136678d3f2a87e89332.doc

  • Size

    92KB

  • MD5

    a63bcef430a4908df07b0219bafcfe95

  • SHA1

    ef690233bd922d45dbeea7b35fe5d446030ab232

  • SHA256

    e07b53986c5ca16253418fc2782bf12e834f1292fab71136678d3f2a87e89332

  • SHA512

    854077e59f8a1246a6fafcac15c93faf56ce9b4fa82b5af86653d2c8522294522ff352f98270f5f2ed40b33b1ac89cfaa34cb1443abc1d025c6d3f1f52443146

  • SSDEEP

    1536:0PASfgN3ffjBw0n6zcvH1In5757Fw0Xz+ocAe2YnCSc7sOoQWa8SQs+:733ffem671FwffAePnwsOoQWRSQs+

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e07b53986c5ca16253418fc2782bf12e834f1292fab71136678d3f2a87e89332.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1940-0-0x00007FFB51190000-0x00007FFB511A0000-memory.dmp

    Filesize

    64KB

  • memory/1940-1-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-3-0x00007FFB51190000-0x00007FFB511A0000-memory.dmp

    Filesize

    64KB

  • memory/1940-4-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-6-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-5-0x00007FFB51190000-0x00007FFB511A0000-memory.dmp

    Filesize

    64KB

  • memory/1940-2-0x00007FFB51190000-0x00007FFB511A0000-memory.dmp

    Filesize

    64KB

  • memory/1940-8-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-7-0x00007FFB51190000-0x00007FFB511A0000-memory.dmp

    Filesize

    64KB

  • memory/1940-9-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-10-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-11-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-12-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-13-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-14-0x00007FFB4F100000-0x00007FFB4F110000-memory.dmp

    Filesize

    64KB

  • memory/1940-15-0x00007FFB4F100000-0x00007FFB4F110000-memory.dmp

    Filesize

    64KB

  • memory/1940-24-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-25-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-26-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB

  • memory/1940-30-0x00007FFB91110000-0x00007FFB91305000-memory.dmp

    Filesize

    2.0MB