Analysis
- max time kernel
101s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
11/04/2024, 16:27
General
- Target 2024 xxxxxx 401K Contribution-861396.docx
- Size 17KB
- Sample240411-tygttafd79
- SHA256 2ef235d2dec7891951e8294838fcfa50a286dbb31b83502fb65674fa92df62ee
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024 xxxxxx 401K Contribution-861396.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
6E50DD6B.png
C3D1E195.png
ExcludeDictionaryEN0409.lex
memory/3720-17-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-4-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-2-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-6-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-7-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-8-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-9-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-10-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-12-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-11-0x00007FFE09770000-0x00007FFE09780000-memory.dmp
memory/3720-13-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-14-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-16-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-0-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-5-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-15-0x00007FFE09770000-0x00007FFE09780000-memory.dmp
memory/3720-3-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-20-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-21-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-23-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-18-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-59-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-19-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-1-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-85-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-86-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-87-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-89-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp
memory/3720-88-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp
memory/3720-90-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp