Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 01:09
Behavioral task
behavioral1
Sample
Resume v0.1.doc
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Resume v0.1.doc
Resource
win10v2004-20240412-en
General
-
Target
Resume v0.1.doc
-
Size
39KB
-
MD5
ca5c5a30307f853d9ddd57bf60ebd2ed
-
SHA1
5bb802f8d140818066b78bec2b102dea398dbc16
-
SHA256
4b5f8c83f63c4268e5006c8f7c98fea1196d8a20b195788c65aafe4c399a5eac
-
SHA512
761af1c18986f7ed22ca5f224bf5f954861dffbbfb3626849ab79f2101a2ae46387b94f824c9090073578041f205081e4434ec0764ff71c3e9c751fa972e1e4e
-
SSDEEP
384:+LIieom6t2pwGiSJPw+QD1fT36iDNvxz99E50j7S/t:AIieom6t2M+k77Dxxz99Q
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
calc.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3512 3048 calc.exe WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 1 IoCs
Processes:
calc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings calc.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3048 WINWORD.EXE 3048 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
WINWORD.EXEOpenWith.exepid process 3048 WINWORD.EXE 3048 WINWORD.EXE 3048 WINWORD.EXE 3048 WINWORD.EXE 3048 WINWORD.EXE 5004 OpenWith.exe 3048 WINWORD.EXE 3048 WINWORD.EXE 3048 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 3048 wrote to memory of 3512 3048 WINWORD.EXE calc.exe PID 3048 wrote to memory of 3512 3048 WINWORD.EXE calc.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Resume v0.1.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵
- Process spawned unexpected child process
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCD73B9.tmp\iso690.xslFilesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
memory/3048-13-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-3-0x00007FF7DC0B0000-0x00007FF7DC0C0000-memory.dmpFilesize
64KB
-
memory/3048-16-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-1-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-6-0x00007FF7DC0B0000-0x00007FF7DC0C0000-memory.dmpFilesize
64KB
-
memory/3048-7-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-5-0x00007FF7DC0B0000-0x00007FF7DC0C0000-memory.dmpFilesize
64KB
-
memory/3048-8-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-9-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-10-0x00007FF7DA050000-0x00007FF7DA060000-memory.dmpFilesize
64KB
-
memory/3048-11-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-12-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-14-0x00007FF7DA050000-0x00007FF7DA060000-memory.dmpFilesize
64KB
-
memory/3048-0-0x00007FF7DC0B0000-0x00007FF7DC0C0000-memory.dmpFilesize
64KB
-
memory/3048-529-0x000002D460C00000-0x000002D461BD0000-memory.dmpFilesize
15.8MB
-
memory/3048-4-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-18-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-17-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-20-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-19-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-22-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-23-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-31-0x000002D460C00000-0x000002D461BD0000-memory.dmpFilesize
15.8MB
-
memory/3048-32-0x000002D460C00000-0x000002D461BD0000-memory.dmpFilesize
15.8MB
-
memory/3048-2-0x00007FF7DC0B0000-0x00007FF7DC0C0000-memory.dmpFilesize
64KB
-
memory/3048-381-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-526-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-527-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB
-
memory/3048-528-0x000002D460C00000-0x000002D461BD0000-memory.dmpFilesize
15.8MB
-
memory/3048-15-0x00007FF81C030000-0x00007FF81C225000-memory.dmpFilesize
2.0MB