Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/04/2024, 01:53
General
- Target a6562d8f34d4c25a94313ebbed1137514eed90b233a94a9125e087781c733b37.docm
- Size 16KB
- Sample240401-cbgf4aad3y
- SHA256 a6562d8f34d4c25a94313ebbed1137514eed90b233a94a9125e087781c733b37
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a6562d8f34d4c25a94313ebbed1137514eed90b233a94a9125e087781c733b37.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\signed_20240329011751156.exeC:\ProgramData\signed_20240329011751156.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
signed_20240329011751156.exe
memory/2308-20-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-17-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-4-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-3-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-5-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-7-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-6-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-8-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-9-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-11-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-10-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-13-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-12-0x00007FFDC2F70000-0x00007FFDC2F80000-memory.dmp
memory/2308-14-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-15-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-16-0x00007FFDC2F70000-0x00007FFDC2F80000-memory.dmp
memory/2308-0-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-18-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-2-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-19-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-31-0x0000026075AA0000-0x0000026076A70000-memory.dmp
memory/2308-22-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-23-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-21-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-32-0x0000026075AA0000-0x0000026076A70000-memory.dmp
memory/2308-1-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-43-0x0000026075AA0000-0x0000026076A70000-memory.dmp
memory/2308-49-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-51-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-52-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-53-0x0000026075AA0000-0x0000026076A70000-memory.dmp
memory/2308-54-0x0000026075AA0000-0x0000026076A70000-memory.dmp
memory/2308-55-0x0000026075AA0000-0x0000026076A70000-memory.dmp
memory/2308-76-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-77-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-78-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-79-0x00007FFDC58D0000-0x00007FFDC58E0000-memory.dmp
memory/2308-81-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp
memory/2308-80-0x00007FFE05850000-0x00007FFE05A45000-memory.dmp