Analysis
-
max time kernel
101s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10-07-2024 15:03
General
-
Target
10072024_1503_09072024_HUGHUR343EDRFQ.docx
-
Size
16KB
-
MD5
830c2b82a06eeb1950161dc65f313bda
-
SHA1
01fd8522710ffd0635f2755dc93ca7b1485b0bae
-
SHA256
2e866dc1f844a29e6b551e4a111147f05125d598cac2c5424fa0cc1a73ef07b8
-
SHA512
f594cbe8a500bbe1e5cc59879af4c8a05a2da0ab2f3b2ae3f214c5793db82fe9109e7b5d28a56d925edb8c2564389bba7b72b482d9c6fc9ea85622ed2768968a
-
SSDEEP
384:WyXBnQPWys8PL8wi4OEwH8TIbE91r2fRyJYRvi49U1Gk:WcBUh5P3DOqnYJswvR9U1p
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10072024_1503_09072024_HUGHUR343EDRFQ.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
474KB
MD50c8f476fd30221bed38c4a5e58bdcd53
SHA10d239a8ba1fb453758e497434e9c1012f39e58f7
SHA256ebc1ebcbbb9138771433da50dbc388ad4947cc10f0825602160c4451a2d5af7b
SHA5123bd55c06dbd04e595b07761f277f02d464f801feefe386fda9288a1f38e7a084990402b6c18abe562d7e75ca9ee272c5a76e4120f16fc70e4840e99d4503fa58
-
Filesize
419B
MD50b8be55a0068bf84529e7e86ca7dd97e
SHA19dae25bcabd620a02b630db1f7d7d979bbed7fe4
SHA256f913d650932e2d75cdd8e86f7df8d7b416ac027ac119621289f54a4411b4e4c1
SHA512dd55d21008a47693ae7d847167bbd99ff4b01d1fa064bcfee838450afb471390980fc9f9ffef1917cc3627eda2e75f673e9657a579b87b8c72e2091a00171dc7
-
Filesize
3KB
MD5c1ac3aa5b7688917e70e3db811044ebf
SHA1c9a5411ac600b50bdb97e32a9f964e24c6361a8d
SHA25669e3bbfd8f40275baabfd8888cb0d324f4e92eb61385b0c7ea8fe1d4893c1c50
SHA5122083fb2ebf2f0101ba76e21f467024a7c34dc5ea7bbab444bece085979688d9ad5e3905bf7b38db5b9f3eacca9787b77a8dcfcb65ed1abd6509d771d767ab78f
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB