Analysis
-
max time kernel
101s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18-04-2024 07:11
General
-
Target
0eab45741c6d3abdb145b7c928d045dc77cf3def915d017abc388c2c38da8137.docx
-
Size
558KB
-
MD5
bb683a0e1b197cab5dce152e9355983f
-
SHA1
48dab24779ecf13e3c130107e950514e46046c11
-
SHA256
0eab45741c6d3abdb145b7c928d045dc77cf3def915d017abc388c2c38da8137
-
SHA512
2ab668822fe5742dc4d69e6f0ffebbc2edf01832d997a414b36db0fad71b1c63dac633358a6ef1b6211df8e367a7e87e533ab20d8b6c29ed82d02ab6449fc7f3
-
SSDEEP
12288:1IAODfjgJ4h1dPjcXUk+MifcXUk+MiQWHOOkxogMm+JJgiXSV3VNycXUk+Mid:KvY4h7P4XUQXUUWHOOkdMm+JJgioVNPa
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0eab45741c6d3abdb145b7c928d045dc77cf3def915d017abc388c2c38da8137.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD51fcb3f34b5588f6a647a06dff1811bf9
SHA11f5ef0e6e41c14795decedcefc883ab9000fac9a
SHA256a99e8172248dac0b2a6243d06a862901989857b0c2ecbed5f25ddb0d1a95154e
SHA51247e951583afff444f9adb09beab0d83f9792b46d3e1fabf05d21068218d64b3cba48e2dc22fe0a7bd3252a0e0c8866faa244b5dc3784bd336ecbc9f2924fb2aa
-
Filesize
74KB
MD59278d07272accaf33d132bb6dbf6a7e7
SHA12baca87c9698a70badda973491cdb8fdc82982d5
SHA2565aebe72f050d5977cccf05c5c21bd56dab2c8caf96b9edcf9b1bcfabcf0702fc
SHA51234efd47cc1960994b46211979e0f2cc158d3a87d1af61e9d904d28481a3313129100c46556caa9c27e9309aac162a354df8893d1211ca85d17947b8daf5c405e
-
Filesize
1.4MB
MD54d59a7e93170340b5ec4009f7fa3ad31
SHA1e07421156dd87789f93f10904118343ca452bbb5
SHA25683473215e5c2160333aa92ea7f9b1276d8ed7dd66afc472dc92c88055d189d7d
SHA512415102ad30df62a63ec47d7b432ab397c2cfc8b6f7fe1e8a7057877379b65d344499089780e089ad2f5c08e3050f4dc2205e7c3c4ffe484c39d067027783ab55
-
Filesize
241B
MD569bcf27cddde0d71bcfb233eaf009dc8
SHA11f40b09f0e1201a86a88286ec3ebfb60401f7568
SHA2566c4e0e2489265d06e013002e1b864bdbf5ffca5d47d540b9e1af174478eb0fcc
SHA512c11cd686fd3ac1373cbde01dd4af1ab706b173270974ce0ae8a0ff59b7ed4b66c581c4b830dcca1244bede59f6b76064de62026722cd2fa56cc799a9f19c5a8d
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB