Analysis

  • max time kernel
    135s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 08:24

General

  • Target

    SPEC2125460_Hays_28052024.doc

  • Size

    45KB

  • MD5

    935b83ed90c272d9f671d99c11034d36

  • SHA1

    7e04ee0d8f5f06bbbdea956382f2db0c45a673ae

  • SHA256

    ccec18194b482026ffb428b0193a51891c6131e1637a8597498a33fd9634ac89

  • SHA512

    a148b08c49b980b8a7036b15785bf09b9ec9fe8cc87f2bc5403729dfb2d8f3e801ca8d7a4c64988ac7f1208a00f89c73c36aa2bcd0e5ff5643632389dbce6f49

  • SSDEEP

    768:hGbTVKRxvn/yV2ET8c2OjOeXO+kV6mGxGMGT4kiGk:fvn28V+kV6mGxGMGT4kiGk

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SPEC2125460_Hays_28052024.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4400
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
    1⤵
      PID:4412

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\TCD522B.tmp\gb.xsl

            Filesize

            262KB

            MD5

            51d32ee5bc7ab811041f799652d26e04

            SHA1

            412193006aa3ef19e0a57e16acf86b830993024a

            SHA256

            6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

            SHA512

            5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

          • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/4400-14-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-18-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-5-0x00007FF9B088D000-0x00007FF9B088E000-memory.dmp

            Filesize

            4KB

          • memory/4400-0-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-6-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-7-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-8-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-9-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-10-0x00007FF96E760000-0x00007FF96E770000-memory.dmp

            Filesize

            64KB

          • memory/4400-12-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-11-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-13-0x00007FF96E760000-0x00007FF96E770000-memory.dmp

            Filesize

            64KB

          • memory/4400-1-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-15-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-4-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-22-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-17-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-21-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-19-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-20-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-16-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-2-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-3-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-519-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB

          • memory/4400-556-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-557-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-555-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-558-0x00007FF970870000-0x00007FF970880000-memory.dmp

            Filesize

            64KB

          • memory/4400-559-0x00007FF9B07F0000-0x00007FF9B09E5000-memory.dmp

            Filesize

            2.0MB