Analysis

  • max time kernel
    450s
  • max time network
    455s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 18:16

General

  • Target

    KNV LA/License_NL.rtf

  • Size

    51KB

  • MD5

    eefbe9dec1f4892c0a5a812e652bedcf

  • SHA1

    d1f981c087fd644ea2844a3d2490ee611245470f

  • SHA256

    7b76814797f07abdd612f20176465d7fbef8fd0c5d4d8097680aae1d658c2df3

  • SHA512

    2ca443cdcce414bc5ffdd916d471bcd82863a3a624a602bac8180f4886f95f5c7c93ccadb259110c8e14678c7835e16297e152a24253184db467cfb27e945249

  • SSDEEP

    384:GJtAfWq6UPz44sdaHyuCtOke3IoWr2bx4DrU8Emg2Ii6rGs2AYARv6ZNYGb:GJoyuCtOke3IHi2r/EgrhAkDb

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\KNV LA\License_NL.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD8313.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • memory/4680-15-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-537-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-4-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-2-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-5-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-6-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-7-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-8-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-9-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-10-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-11-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-13-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-538-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-3-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-0-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-16-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-17-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-18-0x00007FF96E3B0000-0x00007FF96E3C0000-memory.dmp

    Filesize

    64KB

  • memory/4680-14-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-356-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-484-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-483-0x00007FF9B048D000-0x00007FF9B048E000-memory.dmp

    Filesize

    4KB

  • memory/4680-503-0x00007FF9B03F0000-0x00007FF9B05E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4680-535-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-536-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-1-0x00007FF9B048D000-0x00007FF9B048E000-memory.dmp

    Filesize

    4KB

  • memory/4680-534-0x00007FF970470000-0x00007FF970480000-memory.dmp

    Filesize

    64KB

  • memory/4680-12-0x00007FF96E3B0000-0x00007FF96E3C0000-memory.dmp

    Filesize

    64KB