Overview
overview
8Static
static
8�...��.doc
windows7-x64
4�...��.doc
windows10-2004-x64
1�...��.doc
windows7-x64
4�...��.doc
windows10-2004-x64
1�...�.docx
windows7-x64
4�...�.docx
windows10-2004-x64
1�...��.doc
windows7-x64
4�...��.doc
windows10-2004-x64
1�...�.docx
windows7-x64
4�...�.docx
windows10-2004-x64
1�...�.docx
windows7-x64
4�...�.docx
windows10-2004-x64
1�...�.docx
windows7-x64
4�...�.docx
windows10-2004-x64
1�...�.docx
windows7-x64
4�...�.docx
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 07:34
Behavioral task
behavioral1
Sample
ڵʮղѧ2016�.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ڵʮղѧ2016�.doc
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
ڵʮղѧ2016�.doc
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
ڵʮղѧ2016�.doc
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
ڵʮղѧ2016�.docx
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
ڵʮղѧ2016�.docx
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
ڵʮղѧ2016�.doc
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ڵʮղѧ2016�.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ڵʮղѧ2016�.docx
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
ڵʮղѧ2016�.docx
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
ڵʮղѧ2016�.docx
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
ڵʮղѧ2016�.docx
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
ڵʮղѧ2016�.docx
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
ڵʮղѧ2016�.docx
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
ڵʮղѧ2016�.docx
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
ڵʮղѧ2016�.docx
Resource
win10v2004-20240412-en
General
-
Target
ڵʮղѧ2016�.doc
-
Size
82KB
-
MD5
8aa495da680817c53200ec17c83b1493
-
SHA1
a9bdd6fede83a7c8ced37dca2d4c3bbd9ab88eb8
-
SHA256
9f9ce215abd323fefd32c3e18ffc10675dae0b873c367e6e3795c1e2cce61caf
-
SHA512
b3912d936f496a0837db825d51035d0bf8e064c70ee4fa3148b31862c510189f6106b7070157211e1b39a9b1c277e2f9ad2a06abac040b842fa7887b71e00da6
-
SSDEEP
768:E3JLzDmHtPD15UUdC2Ug9YvQKAjYNOHCAPotHuq3x+/jhU:AfqYKkg9YpNOHCAPow
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 316 WINWORD.EXE 316 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE 316 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ڵʮղѧ2016�.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
23KB
MD5da08e01fd44cda299f85cf5fcf8a8c73
SHA17473baa597dd62dfc3875339506f89245ff9d100
SHA2568654f3768545b3ee70443039d949eec48e6441eabf484524a908f00259649cdd
SHA512903eb85d6da6ab7d459517a1a9d83b1b67ae4f58e4c9499fecd2de44c880ba4c4a8ca4719b08ab47cb203fd89007dc9339a205f2a4b80cc1d9a1db98de67cee1