Overview
overview
10Static
static
1!ŞetUp_92...ot.dll
windows7-x64
1!ŞetUp_92...ot.dll
windows10-2004-x64
1!ŞetUp_92...ee.dll
windows7-x64
1!ŞetUp_92...ee.dll
windows10-2004-x64
1!ŞetUp_92...up.exe
windows7-x64
10!ŞetUp_92...up.exe
windows10-2004-x64
10!ŞetUp_92...se.dll
windows7-x64
1!ŞetUp_92...se.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1acdbase.dll
windows7-x64
1acdbase.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1assured.doc
windows7-x64
1assured.doc
windows10-2004-x64
1ezcd.exe
windows7-x64
10ezcd.exe
windows10-2004-x64
10libmmd.dll
windows7-x64
1libmmd.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AbRoot.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AbRoot.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AdTree.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AdTree.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/acdbase.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/acdbase.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
acdbase.dll
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
acdbase.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
assured.doc
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
assured.doc
Resource
win10v2004-20240709-en
Behavioral task
behavioral26
Sample
ezcd.exe
Resource
win7-20240708-en
Behavioral task
behavioral27
Sample
ezcd.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral28
Sample
libmmd.dll
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
libmmd.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral30
Sample
vcruntime140.dll
Resource
win7-20240705-en
Behavioral task
behavioral31
Sample
vcruntime140.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral32
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20240709-en
General
-
Target
assured.doc
-
Size
36KB
-
MD5
a285fc5707d7197e033594c2964f4fd5
-
SHA1
2ef147d12ba18602e176937a364f215b1aa7dde7
-
SHA256
67d660868b2f5b271ffdeb59ac915f2c978a51495b51ec11a41ac376e8bc8a19
-
SHA512
aa4400f70471d3e698ca0d5fed1d83d9be3c13b5cd472ac43adfed82a71f2a0f2bc6aef9dda5167fb8a598446d48475dfc7907ac03d8f07cd16e999b56baa8e7
-
SSDEEP
768:jbOJj51xQ3i1PfDw3skXyllMGBGkj6RGWJqraK:nS1xe6u2pGkOosYt
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 864 WINWORD.EXE 864 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE 864 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\assured.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:864