Analysis
-
max time kernel
104s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22-07-2024 20:26
General
-
Target
05220527b8741ab6783e863892b875a0N.docx
-
Size
602KB
-
MD5
05220527b8741ab6783e863892b875a0
-
SHA1
733b9d8c91d330c6f1643b6efde429af69adb713
-
SHA256
0ee1feb54361c653349fe5edea22519b03a52a899c5db0103a075448293c452a
-
SHA512
9eda695207c4c023a1c9ae0af0f34f5c55c964b87cdb98f4410b8d4c50cf95bb26b0ac81ded6e2db00b6c55b02d9787165fdf3aeed321bacf389f3ade05d129d
-
SSDEEP
12288:gT2t3XGysjgLaMI9/zilGCDoYrM9lNa27LGzU:gtysFMozi8CDoOM0An
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\05220527b8741ab6783e863892b875a0N.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD5a5b49a08477684f50f5e2a45c11e5ae8
SHA121b389940753a91eb6b1fbd6f0e96d44743f30de
SHA256ccf24cec0594d4cf3f87df4fc8a87192e2a9dbd965be8ca92e50005ffd83d137
SHA51256f0b935b9dbafe3fa845403ea8eedf65af1707892a5d79c6d5b7d7406045b442dbbbcae477998e1f8669fb80c6f97f8f0df6ee054a0e2136a2bea49d1bbe05c
-
Filesize
91KB
MD5034e661a8a618c2a1596205d982f769d
SHA1181667161e04c2b4336706a09567975979388ce4
SHA2560a83a66a638007b4d23dbe6c6a766ac1c95dc80fcbd7adc4b6f81ec8b3a50885
SHA512813afe8901e3256a77564550587d6c53fe52a5d14282d598b1ddd6b0871d93a77513fc0094cbb3a568d25f866b67f1cf711528963a10b0c7639c1a8b1d791f35
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
371B
MD51499593d1509d7b41732dbf1004fbaad
SHA1dfda75e1aa0acc83f97b2e45f0c2240fc9cb5e65
SHA2567e4b2788e1cdb0c2e63441f47e7a9fda5e26b9a16bc0c2f5ddd3fa84ac04a95e
SHA512af5a38723a931cffdf36aeefda8a3d92a84f7be3740a0a1a7762387ca7bf95f724355d5cf6e1495face12f7fad67e50d880e076b890891fb5d12fae9f4d233b8
-
Filesize
3KB
MD5d2187a45d01419d555a4b64f1febe2be
SHA15dff7e3aaa517d53feb277a18d72da2ed6327626
SHA256afa5abe7796c12ecc3be5c111e6603a4a31b4f50d2c239e93a70ccfcb67ce6a1
SHA512cc5273f4d2be3c4bab838a2ec558755f6af7805c12006e796cecf0dfc2b8dcd977976a5b2003b950f72010ed6c975cdeb29930fec779079728d135e3f25492cf
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB