Analysis
- max time kernel
135s - max time network
139s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
01/07/2024, 12:39
General
- Target Offer ZI-0428.rtf
- Size 293KB
- Sample240701-pvt8hssbpd
- SHA256 95be57795b850e5aa098c80a107bafdb581da7653d9b57b8f2d37b89880de224
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Offer ZI-0428.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
memory/3368-13-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-28-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-3-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-4-0x00007FF9712F5000-0x00007FF9712F6000-memory.dmp
memory/3368-5-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-10-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-9-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-8-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-12-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-11-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-14-0x00007FF92E470000-0x00007FF92E480000-memory.dmp
memory/3368-16-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-15-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-0-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-2-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-17-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-1-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-24-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-25-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-27-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-18-0x00007FF92E470000-0x00007FF92E480000-memory.dmp
memory/3368-26-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-23-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-644-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-761-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-763-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-760-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-762-0x00007FF9312E0000-0x00007FF9312F0000-memory.dmp
memory/3368-764-0x00007FF971250000-0x00007FF97142B000-memory.dmp
memory/3368-765-0x00007FF971250000-0x00007FF97142B000-memory.dmp