Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 07:29
Static task
static1
Behavioral task
behavioral1
Sample
!~!SetUp_2025_Pa$$W0rd$s!!%!~/Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
!~!SetUp_2025_Pa$$W0rd$s!!%!~/Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
!~!SetUp_2025_Pa$$W0rd$s!!%!~/d3dx9_43.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
!~!SetUp_2025_Pa$$W0rd$s!!%!~/d3dx9_43.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
!~!SetUp_2025_Pa$$W0rd$s!!%!~/heartthrob.doc
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
!~!SetUp_2025_Pa$$W0rd$s!!%!~/heartthrob.doc
Resource
win10v2004-20240709-en
General
-
Target
!~!SetUp_2025_Pa$$W0rd$s!!%!~/heartthrob.doc
-
Size
77KB
-
MD5
42e6685956ce07bdfe900b44dfda8555
-
SHA1
29d8ca5bae80f4d1ced66683d2ebd64a90b5eff7
-
SHA256
7f4dc10f712c2d0d4ae5f24e3defb4fcbeb1b38a7dd357a7473f954abe8faf0d
-
SHA512
4d293d2f298d108afdd854bf43bd1c0bb18a29082c94c7559e667bb0bb155584437cb4d4212a9ca0f19ccab766f5de42ded0d381ec071f193f9db1c1672c2a67
-
SSDEEP
1536:02WkXRPQqe0N7OoGvvHDkh9e0rafDfy7RsY3U:3Dh3xsPDUe04LSs+U
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid Process 1712 WINWORD.EXE 1712 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
WINWORD.EXEpid Process 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE 1712 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\!~!SetUp_2025_Pa$$W0rd$s!!%!~\heartthrob.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1712