Analysis
- max time kernel
146s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/04/2024, 00:38
General
- Target $PLUGINSDIR/license_BL.rtf
- Size 80KB
- Sample240408-azeajabe3y
- SHA256 cc6534428c6239f68d39ec82d1325c24e17e7e8085acd36ba1a61bbe22c4d4f6
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_BL.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4800-0-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-1-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-2-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-3-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-4-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-5-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-7-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-6-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-8-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-9-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-10-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-11-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-12-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-14-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-13-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-15-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-16-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-17-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-18-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-19-0x00007FFDC2C70000-0x00007FFDC2C80000-memory.dmp
memory/4800-20-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-22-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-21-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-23-0x00007FFDC2C70000-0x00007FFDC2C80000-memory.dmp
memory/4800-37-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-38-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-39-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-62-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-63-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-65-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-64-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmp
memory/4800-66-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-67-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-68-0x00007FFE05430000-0x00007FFE05625000-memory.dmp
memory/4800-69-0x00007FFE05430000-0x00007FFE05625000-memory.dmp