Overview
overview
5Static
static
3AddOn/Main...On.dll
windows10-2004-x64
1Documents/KxRun.exe
windows10-2004-x64
3Documents/...DE.pdf
windows10-2004-x64
1Documents/...EN.pdf
windows10-2004-x64
1Documents/...ES.pdf
windows10-2004-x64
1Documents/...FR.pdf
windows10-2004-x64
1Documents/...IT.pdf
windows10-2004-x64
1Documents/...JA.pdf
windows10-2004-x64
1Documents/...NL.pdf
windows10-2004-x64
1Documents/...PT.pdf
windows10-2004-x64
1Documents/...RU.pdf
windows10-2004-x64
1KMNV.dll
windows10-2004-x64
1KNV LA/License_DE.rtf
windows10-2004-x64
1KNV LA/License_EN.rtf
windows10-2004-x64
1KNV LA/License_ES.rtf
windows10-2004-x64
1KNV LA/License_FR.rtf
windows10-2004-x64
1KNV LA/License_IT.rtf
windows10-2004-x64
1KNV LA/License_JA.rtf
windows10-2004-x64
1KNV LA/License_KO.rtf
windows10-2004-x64
1KNV LA/License_NL.rtf
windows10-2004-x64
1KNV LA/Lic...BR.rtf
windows10-2004-x64
1KNV LA/License_RU.rtf
windows10-2004-x64
1KNV LA/Lic...CH.rtf
windows10-2004-x64
1KNV LA/Lic...CH.rtf
windows10-2004-x64
1KNV/Netviewer.exe
windows10-2004-x64
3KmInst32.exe
windows10-2004-x64
1KmInst64.exe
windows10-2004-x64
1KmInstall.exe
windows10-2004-x64
5Readme.html
windows10-2004-x64
1Readme_j.html
windows10-2004-x64
1Setup.exe
windows10-2004-x64
1support/Setup.exe
windows10-2004-x64
5Analysis
-
max time kernel
450s -
max time network
455s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 18:16
Behavioral task
behavioral1
Sample
AddOn/MainTargetAddOn.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
Documents/KxRun.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Documents/Net Viewer User Guide DE.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
Documents/Net Viewer User Guide EN.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Documents/Net Viewer User Guide ES.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
Documents/Net Viewer User Guide FR.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Documents/Net Viewer User Guide IT.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
Documents/Net Viewer User Guide JA.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Documents/Net Viewer User Guide NL.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
Documents/Net Viewer User Guide PT.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Documents/Net Viewer User Guide RU.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
KMNV.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
KNV LA/License_DE.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
KNV LA/License_EN.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
KNV LA/License_ES.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
KNV LA/License_FR.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
KNV LA/License_IT.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
KNV LA/License_JA.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
KNV LA/License_KO.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
KNV LA/License_NL.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
KNV LA/License_PT-BR.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
KNV LA/License_RU.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
KNV LA/License_SCH.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
KNV LA/License_TCH.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
KNV/Netviewer.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral26
Sample
KmInst32.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
KmInst64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
KmInstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Readme.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
Readme_j.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
support/Setup.exe
Resource
win10v2004-20240508-en
General
-
Target
KNV LA/License_NL.rtf
-
Size
51KB
-
MD5
eefbe9dec1f4892c0a5a812e652bedcf
-
SHA1
d1f981c087fd644ea2844a3d2490ee611245470f
-
SHA256
7b76814797f07abdd612f20176465d7fbef8fd0c5d4d8097680aae1d658c2df3
-
SHA512
2ca443cdcce414bc5ffdd916d471bcd82863a3a624a602bac8180f4886f95f5c7c93ccadb259110c8e14678c7835e16297e152a24253184db467cfb27e945249
-
SSDEEP
384:GJtAfWq6UPz44sdaHyuCtOke3IoWr2bx4DrU8Emg2Ii6rGs2AYARv6ZNYGb:GJoyuCtOke3IHi2r/EgrhAkDb
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4680 WINWORD.EXE 4680 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE 4680 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\KNV LA\License_NL.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e