Analysis

  • max time kernel
    147s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 09:32

General

  • Target

    0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.doc

  • Size

    2.3MB

  • MD5

    3f326da2affb0f7f2a4c5c95ffc660cc

  • SHA1

    f38abb67d47a4f69536ae67aa9c6df7287c08869

  • SHA256

    0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b

  • SHA512

    83b322f899801920604457910c262500490f518591d9d0eefaccec59db98b546c76cfc4c1ac7f2fb08253b1201d76c5d6eaf5600a6d3793c4f3cba16c1f8cd18

  • SSDEEP

    24576:uguUgXlNGKIZyltJSR3PlRiBwlvQn5tNXw9OSTwbB3UGIpVoR1sLAXI3TYF+PXyx:unUgQWtIBlR7vQN3dBMRUXIDkCy

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.doc" /o ""
      2⤵
      • Deletes itself
      • Checks processor information in registry
      • Enumerates system info in registry
      • NTFS ADS
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3524
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:4956
      • C:\Windows\system32\expand.exe
        expand "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateConf.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateConf.lnk"
        2⤵
        • Drops startup file
        PID:2264
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe
        2⤵
          PID:4720

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FBF60AF5.wmf

              Filesize

              316B

              MD5

              fe97064665ebe15dd56dde1edd2df969

              SHA1

              fc1133b9d239822dc7e52d48b242dc5dedd3393f

              SHA256

              b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8

              SHA512

              5b81d88df4a0627d51ce5b0cd3852b4a16299f099026d998763ea374b9f4a5b877faf25c5be1d9ccfb3223f079b382a027a99d82f862607e4455f7bb3fd365b7

            • C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp

              Filesize

              4.2MB

              MD5

              b56c39d20fc1487e247e6cb8aa0b65c4

              SHA1

              a37b52c7f8c7adb55188aeb5994066ae38f87e1c

              SHA256

              e8790e6ddde06338f69d272d2a6b18c0bd56d011f49e94ad5ba3964fc9ea2db5

              SHA512

              50ee3afe32a10feacc8d57719925c566bc6b1a602f73904b34c0625f560cd9586f61db8b3626c0ed0269f3a3705707bd858ffe36084c9e142e25583d4e6d8510

            • C:\Wíndows\system32\wuaueng.dll

              Filesize

              227KB

              MD5

              490c885dc7ba0f32c07ddfe02a04bbb9

              SHA1

              294690c1aee8dc7723858dafcb2a0ed273296641

              SHA256

              829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1

              SHA512

              127f014d18b926433d56bfee85b350fe36cc26a1442ef8f16cf1c9e6cce95c2f83a8609b9d29e53b7b5617739f760ba4263bd6222870fd25309a16d46000d29c

            • \??\c:\users\admin\appdata\local\temp\windowsupdateconf.lnk

              Filesize

              842B

              MD5

              b6dd036749beb8035b4d733de1aaae1d

              SHA1

              ddd8cf574775c4fcba6ebca9783229f6c19401e6

              SHA256

              8c3451acc329c747c6660fa53c6fd20c40617750c7dad9c688c0cf25523d3ef4

              SHA512

              73f1a6c63dd68ec5b6f5ef72f9dcf274a75139373d672386327af82425b2b455aee6db884e44b8b30de9dc79e6458b8dee02c13b78b60986261654a5afb9fc9b

            • memory/3352-125-0x0000000002580000-0x0000000002581000-memory.dmp

              Filesize

              4KB

            • memory/3352-126-0x00000000084C0000-0x0000000008542000-memory.dmp

              Filesize

              520KB

            • memory/3352-135-0x00000000084C0000-0x0000000008542000-memory.dmp

              Filesize

              520KB

            • memory/3352-137-0x0000000180000000-0x000000018001B000-memory.dmp

              Filesize

              108KB

            • memory/3352-193-0x0000000002180000-0x00000000021A6000-memory.dmp

              Filesize

              152KB

            • memory/3352-187-0x0000000002140000-0x000000000217C000-memory.dmp

              Filesize

              240KB

            • memory/3352-173-0x00000000084C0000-0x0000000008542000-memory.dmp

              Filesize

              520KB

            • memory/3524-19-0x00007FFB606F0000-0x00007FFB60700000-memory.dmp

              Filesize

              64KB

            • memory/3524-5-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-8-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-9-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-10-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-11-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-12-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-13-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-14-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-15-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-16-0x00007FFB606F0000-0x00007FFB60700000-memory.dmp

              Filesize

              64KB

            • memory/3524-17-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-18-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-7-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-29-0x000001AE7A2D0000-0x000001AE7A4D0000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-43-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-57-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

              Filesize

              15.8MB

            • memory/3524-90-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

              Filesize

              15.8MB

            • memory/3524-113-0x00007FFB78D80000-0x00007FFB78FD9000-memory.dmp

              Filesize

              2.3MB

            • memory/3524-4-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-6-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-118-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

              Filesize

              15.8MB

            • memory/3524-128-0x0000000180000000-0x0000000180097000-memory.dmp

              Filesize

              604KB

            • memory/3524-164-0x000001AE7A2D0000-0x000001AE7A4D0000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-165-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

              Filesize

              15.8MB

            • memory/3524-166-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

              Filesize

              15.8MB

            • memory/3524-167-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

              Filesize

              15.8MB

            • memory/3524-3-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-236-0x0000000180000000-0x0000000180097000-memory.dmp

              Filesize

              604KB

            • memory/3524-235-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3524-234-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-2-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-1-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-0-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-231-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-232-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/3524-233-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

              Filesize

              64KB

            • memory/4720-185-0x000002B2D7100000-0x000002B2D7154000-memory.dmp

              Filesize

              336KB

            • memory/4720-182-0x000002B2D7100000-0x000002B2D7154000-memory.dmp

              Filesize

              336KB

            • memory/4720-174-0x000002B2D7100000-0x000002B2D7154000-memory.dmp

              Filesize

              336KB