Analysis
-
max time kernel
116s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
25-06-2024 01:37
General
-
Target
927e8668d7e5b22d0d278cb66ecbb15a51420f2fc5299aaa324d43a7d04719a2.docx
-
Size
16KB
-
MD5
9edc82805ecc2d30f07d99973883c3c6
-
SHA1
877fae637a454593a1b66bfede20356803833266
-
SHA256
927e8668d7e5b22d0d278cb66ecbb15a51420f2fc5299aaa324d43a7d04719a2
-
SHA512
b24ed91e3f53fe2cfc0b0fdaebcd495cbc878507187a802ed019736be707d5d832f149360dba0cfd394df5e0406bd979fda5aff4357fe4e2bede514098fc8cf3
-
SSDEEP
384:tyXxo8qWds8PL8wi4OEwH8TIbE91r2fR3JYovij7XCnp:tcxIq5P3DOqnYJZ1vO7XCp
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\927e8668d7e5b22d0d278cb66ecbb15a51420f2fc5299aaa324d43a7d04719a2.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
604KB
MD52d1b096a33d1b673fd06db9f3e861761
SHA13c0a1d1bd1b54381df8769ecc173e8635fea366e
SHA256bf89362748b9e66c11aaa49ddf83b1665fe038d04225b36de4f26cffc11a0f3d
SHA51232156517472c8c4a6998e58bb90e0a684516a11c403d87524a8561f647901cdb9413dd71b55df4de52c88e5e522e06ee9565fc6dc653ec8f49ba5c58a3d5034e
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
257B
MD5387709e7512100f66f8d6464bc22c26a
SHA1b4b5b908b4fd2689b7b3d8ca90ff4b07a9a0dd45
SHA256437f241d18289d8830bc19365d7bd30cf0a745466e23fe0d7664f0d4c8c5f855
SHA5126647600491194e54e4fd31a8a38e69e564668e2cb49aa8104c55995dd6f30f6dcd0d0ff15ad63180a63e145944540ee45667efbad784ebb80397eb9ee60402cf
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB