Overview
overview
5Static
static
329a232/29A#2.js
windows7-x64
329a232/29A#2.js
windows10-2004-x64
329a232/29A#2.vbs
windows7-x64
129a232/29A#2.vbs
windows10-2004-x64
129a232/29A#2.vbs
windows7-x64
129a232/29A#2.vbs
windows10-2004-x64
129a232/29A#2.ps1
windows7-x64
329a232/29A#2.ps1
windows10-2004-x64
329a232/29A#2.vbs
windows7-x64
129a232/29A#2.vbs
windows10-2004-x64
129a232/29A#2.exe
windows7-x64
29a232/29A#2.exe
windows10-2004-x64
29a232/FIL...OC.exe
windows7-x64
129a232/FIL...OC.exe
windows10-2004-x64
129a232/FILES/IAVR.exe
windows7-x64
29a232/FILES/IAVR.exe
windows10-2004-x64
29a232/FIL...EC.com
windows7-x64
29a232/FIL...EC.com
windows10-2004-x64
ANDROID.com
windows7-x64
ANDROID.com
windows10-2004-x64
ANIMO.com
windows7-x64
ANIMO.com
windows10-2004-x64
ANTI-ETA.exe
windows7-x64
ANTI-ETA.exe
windows10-2004-x64
BABYBUG.exe
windows7-x64
BABYBUG.exe
windows10-2004-x64
CABANAS.exe
windows7-x64
5CABANAS.exe
windows10-2004-x64
5CAP.doc
windows7-x64
4CAP.doc
windows10-2004-x64
1CARRIERS.com
windows7-x64
CARRIERS.com
windows10-2004-x64
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 17:45
Static task
static1
Behavioral task
behavioral1
Sample
29a232/29A#2.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
29a232/29A#2.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
29a232/29A#2.vbs
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
29a232/29A#2.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
29a232/29A#2.vbs
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
29a232/29A#2.vbs
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
29a232/29A#2.ps1
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
29a232/29A#2.ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
29a232/29A#2.vbs
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
29a232/29A#2.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
29a232/29A#2.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
29a232/29A#2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
29a232/FILES/GETPROC.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
29a232/FILES/GETPROC.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
29a232/FILES/IAVR.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
29a232/FILES/IAVR.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
29a232/FILES/PEWRSEC.com
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
29a232/FILES/PEWRSEC.com
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
ANDROID.com
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
ANDROID.com
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
ANIMO.com
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
ANIMO.com
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
ANTI-ETA.exe
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
ANTI-ETA.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
BABYBUG.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
BABYBUG.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
CABANAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
CABANAS.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
CAP.doc
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
CAP.doc
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
CARRIERS.com
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
CARRIERS.com
Resource
win10v2004-20240508-en
General
-
Target
CAP.doc
-
Size
14KB
-
MD5
f6fa447c9b9e34afe8cd17fe1e6cd23c
-
SHA1
be9b900d0b4d18837903915e00587da4e798b0d8
-
SHA256
d0de5ea3b65a67e727215d3c92cd26d304ce325cbebe6877e35b0377c07502bb
-
SHA512
007c22468477141cf7a32a5c92dc7b29a23090d559bd03221a94d8beea0273896794bd37d90ceef015e65ffd8806303e4b2a4b2f4a9feb3b9678207c765e1ef4
-
SSDEEP
96:CiIpA9NFNHxD4kMirjBCW3XuDcEYrP9tKviXTNFNFYH465gIpAY/grooFKpeRQnp:CiIpsp40rjEWnl9E6XfhVIpV5vpNp
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 212 WINWORD.EXE 212 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE 212 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CAP.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810