Resubmissions
25/06/2024, 08:51
240625-kr7l8azcrc 10Analysis
-
max time kernel
117s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25/06/2024, 08:51
General
-
Target
RY94HT.docx
-
Size
78KB
-
MD5
8a9fa85139fa2d1703b9e829194386e3
-
SHA1
c806f09a1e941406ffc8172d85c2e811d77a2666
-
SHA256
e8f03287c51f6b2992c960c487de1b74d64571a590ce84de7aced738516d699c
-
SHA512
d354c017a0d5873e1fea65048cc1454f944badf8a6d742ec5081f44bae65e08e448c3d27ebf4b274d920aa6a9a5d45bac83705179f6b2f072aad7f504590ee96
-
SSDEEP
1536:qYsWvkcezR1I/qpzVAG3yFqmlkxDvRwuThQgkMf5wzwrI2TafagDiGlOyS+n5cJ8:lXe912Gz3qlOvRxQgrfy92qagDiGloJ8
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RY94HT.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe"C:\Program Files\Microsoft Office\Root\Office16\MsoSync.exe"2⤵
- Process spawned unexpected child process
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD53b04e219cd582f0ade3fef3177471bf4
SHA182e25f9667dbaebd9eb173d2f4389e5380b6ed3f
SHA2567f3359cab6002f5d4ae5213910bc7c2171c1d0383095c70af0b2a8f6d9bd5aff
SHA51200026d874db5bb029bd2c595f3f41ffaae5abb417d23b86dc3f9473b7f5742fc11ca1e2a868d7e9cb5c1024634406be0d7dcb6781a66566266550823c3a9497f
-
Filesize
128B
MD593613f092b43447e50c65482aaa83cc0
SHA1cc159612a0a4f7406cb9454beac572821a62e725
SHA2567af07a3503b5c736e99c982e468b2c42a90b8f8eb990f00ff17f45f76a9ec427
SHA512193043f2968c2ef0b62427e77306873c20ab270409bf37adc758f4b770d1908584ef9b48f07d0c0804e042a764e4c2ce644935e3ac855d41b264257af35ff023
-
Filesize
1.4MB
MD5476c7c2f309c957f6428d04e94c4f64a
SHA1f1b0fa252babfb7002dc87069a436ad71bda532f
SHA256c0da66b866cc999aee20456c2eee3eefc05046b8f5df3755f95fecb85f9f8be5
SHA512c941fbacc6c98b556ea742538b2f2c61a66be677aa5f97457dfe07ea9652e17fe545ac05740f8ed20b1449fdcf38e97c49fe73ff8d53220a4e8d3e6e3615854e
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB