Analysis

  • max time kernel
    24s
  • max time network
    25s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 12:53

General

  • Target

    Corel Preview 2024/Instruction.docx

  • Size

    88KB

  • MD5

    c4a1ed8a268609a1c3fcf548545a8c10

  • SHA1

    32f55fdf7869d33e24ff8523485184baf91ff698

  • SHA256

    ed94e2b9956470c75aa9149d2ba1750e59b465f5771b2f3b2c27feaa3aa91c25

  • SHA512

    c0d7449e08512a2b3560b35e36b800704ae0de51e162fbf7dea0e9c595cff4ad6a1653ad72f83bc1f36e2bbb2382c2742c19ebf856b4eb475d29ba8af995a0c8

  • SSDEEP

    1536:Ll3JZn2c1+nW2iLUetVJxZmOSPdkZtHb9GKzsakB5+1zRCO/8EIMG4xGZX:Ll3vqnW2GhLxMBeZdb9GKIakB5+1zD/S

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Corel Preview 2024\Instruction.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • memory/4804-12-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-525-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-0-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

    Filesize

    64KB

  • memory/4804-2-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

    Filesize

    64KB

  • memory/4804-6-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

    Filesize

    64KB

  • memory/4804-9-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-10-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-8-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-7-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-11-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-13-0x00007FFC11210000-0x00007FFC11220000-memory.dmp

    Filesize

    64KB

  • memory/4804-14-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-4-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

    Filesize

    64KB

  • memory/4804-3-0x00007FFC13B10000-0x00007FFC13B20000-memory.dmp

    Filesize

    64KB

  • memory/4804-5-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-16-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-18-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-19-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-20-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-21-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-22-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-17-0x00007FFC11210000-0x00007FFC11220000-memory.dmp

    Filesize

    64KB

  • memory/4804-1-0x00007FFC53B2D000-0x00007FFC53B2E000-memory.dmp

    Filesize

    4KB

  • memory/4804-513-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-523-0x00007FFC53B2D000-0x00007FFC53B2E000-memory.dmp

    Filesize

    4KB

  • memory/4804-524-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-15-0x00007FFC53A90000-0x00007FFC53C85000-memory.dmp

    Filesize

    2.0MB