Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 09:57

General

  • Target

    221292a9f77f1a16fa0a7ed41b0eedbd312475dd9a5104c7923ed7889ea0f292.docm

  • Size

    1.4MB

  • MD5

    13814a190f61b36aff24d6aa1de56fe2

  • SHA1

    08fd3f4cdcb6e4c3cb28935c41781e5fe84bf0c6

  • SHA256

    221292a9f77f1a16fa0a7ed41b0eedbd312475dd9a5104c7923ed7889ea0f292

  • SHA512

    7010c2168caebc9d01d0cf0113dbb92f0c935c619db5771fffe46b2a72bf249015fb64d672b368d61e046b52a90b67e3a75e14948fd64b66caa00aff3900aed5

  • SSDEEP

    24576:8rlNSREIjCl771rVRpKaPwV8kaUMkj7kWk7xuhai1oM54t9OwdeLx:8rlNSRsFhVRpdgJapgk9qaSl52O51

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\221292a9f77f1a16fa0a7ed41b0eedbd312475dd9a5104c7923ed7889ea0f292.docm" /o ""
    1⤵
    • Drops startup file
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4504

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3FA85365.wmf

            Filesize

            490B

            MD5

            deca94d89bf2303c9e3d30040dae4eb8

            SHA1

            415c089df3c47331353038c4cb03e3098144e70c

            SHA256

            e949fc641179a3948b94e400258af1ebc0c5189b0e5805d5f55bd10878b819e6

            SHA512

            c2f4a3ac7c150cda1ac8ee41749ba1fdfdb7f43b6be2d3deb66be149346baf917135d5e8ddbb4dcad41fb100de5de43f8eb42d3aad48b5d7b2a49db70d9222a5

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\6C342337.jpeg

            Filesize

            236KB

            MD5

            cb4110236f9f987fa62689ba7952f910

            SHA1

            4e62a90dab1e5ba7dd58b7b3f3787e9d3c6e5aa7

            SHA256

            7fbec994354ee45d7dcb11dee54a5ad70d05ae97a4deb231a7bfb70e429fb7a9

            SHA512

            16bef9bc03fb33b32df89dbe81c129cc2d6e83d90b3615f23522395b563927f31a53b8c8b2e8380edaf6da0b9bf7b4d91a2cda8b5c8a2504d5c2ca968b13a21a

          • memory/3836-48-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-16-0x00007FFE78450000-0x00007FFE78460000-memory.dmp

            Filesize

            64KB

          • memory/3836-5-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-6-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-4-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-7-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-8-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-9-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-10-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-11-0x00007FFE78450000-0x00007FFE78460000-memory.dmp

            Filesize

            64KB

          • memory/3836-12-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-14-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-13-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-15-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-17-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-49-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-18-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-19-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-20-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-21-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-36-0x0000028D456A0000-0x0000028D458A0000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-1-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-3-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-0-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-111-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-51-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-60-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-61-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-62-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-63-0x0000028D456A0000-0x0000028D458A0000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-64-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-65-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-66-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-75-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-80-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-2-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-92-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-93-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-50-0x0000028D446D0000-0x0000028D456A0000-memory.dmp

            Filesize

            15.8MB

          • memory/3836-112-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-113-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB

          • memory/3836-114-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-117-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-116-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-118-0x00007FFEBA9B0000-0x00007FFEBABA5000-memory.dmp

            Filesize

            2.0MB

          • memory/3836-115-0x00007FFE7AA30000-0x00007FFE7AA40000-memory.dmp

            Filesize

            64KB