Analysis

  • max time kernel
    100s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240708-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 03:45

General

  • Target

    $PLUGINSDIR/EZT_EULA.rtf

  • Size

    62KB

  • MD5

    3584a8d7f66ffad1b321d682bdd71c12

  • SHA1

    88e7aed78aa695f34200bab80d2686770f8a8d0d

  • SHA256

    482a0dc0ecd1099bc772e3021907635ad53164897dcd3c97d86eda4d00a7a719

  • SHA512

    48a68cc55c006d4eef7cc4c334ccf3caaa4af2aa966157ba3b08eaaabe4f3093ef05745d5e80e342a37a383be0112bbb28f9031977d9e495ea9e09591dd935b4

  • SSDEEP

    384:AGtwgDrN79ozVzEFHQezWf4RnDQg4so6iETJTPwa54vg3Rvjlyb3OEi6rGsNAYAG:AG7QezWwnDQgxPiKvjlc7hAZqCM

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EZT_EULA.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    f260fa104b3458305de56409d17c848b

    SHA1

    50252d41dab7db4837e8b75e427e821511800be9

    SHA256

    8dfbe56eeb112a8be417cbe7b2568a78161ea409af371dc050ded362d212fa6e

    SHA512

    8da4756c062dd227f4425a8e9cb5360979390beeca3ee3d1d3b06ede88e8373d9962055c17ccce5cf7f0a15de052dde3b8845a99669bd12c8f8c27e43b8c3630

  • memory/2132-6-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-55-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-2-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-3-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-5-0x00007FFD5B14D000-0x00007FFD5B14E000-memory.dmp

    Filesize

    4KB

  • memory/2132-0-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-9-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-8-0x00007FFD190A0000-0x00007FFD190B0000-memory.dmp

    Filesize

    64KB

  • memory/2132-11-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-15-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-56-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-4-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-12-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-13-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-14-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-7-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-10-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-1-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-30-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-52-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-53-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-17-0x00007FFD5B0B0000-0x00007FFD5B2A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2132-54-0x00007FFD1B130000-0x00007FFD1B140000-memory.dmp

    Filesize

    64KB

  • memory/2132-16-0x00007FFD190A0000-0x00007FFD190B0000-memory.dmp

    Filesize

    64KB