Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:16
Static task
static1
Behavioral task
behavioral1
Sample
SCB REmittance Advice.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SCB REmittance Advice.rtf
Resource
win10v2004-20240508-en
General
-
Target
SCB REmittance Advice.rtf
-
Size
138KB
-
MD5
a19ff7526e4447064c95123087783231
-
SHA1
28cd27bb7050fb4f5534f584b83ca3be90d64ac8
-
SHA256
bc6fe96306eb0dcd81bbe50db9e9996b01ca39b22efa79fce253d38532353051
-
SHA512
48fdf3b34fad1e18c44e252caf530ded20a595bf0442ea6d50b90b3d623674a5523cd03fbe37ee9268db3d0b22f2d256aa8f8514894188947174b2d0c3fea9fe
-
SSDEEP
1536:6wAlRkwAlRkwAlRkwAlRqQD1vzq1VvkwoYOOG:6wAlawAlawAlawAlgQDdyVvzrO3
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3596 WINWORD.EXE 3596 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE 3596 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SCB REmittance Advice.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCDAFDE.tmp\sist02.xslFilesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
memory/3596-7-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-542-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-12-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-4-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-5-0x00007FFF8512D000-0x00007FFF8512E000-memory.dmpFilesize
4KB
-
memory/3596-6-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-0-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-9-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-8-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-11-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-10-0x00007FFF42B60000-0x00007FFF42B70000-memory.dmpFilesize
64KB
-
memory/3596-13-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-3-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-2-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-514-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-17-0x00007FFF42B60000-0x00007FFF42B70000-memory.dmpFilesize
64KB
-
memory/3596-20-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-19-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-18-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-14-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-1-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-16-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/3596-538-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-539-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-541-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-540-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/3596-15-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB