Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
24/07/2024, 01:25
General
- Target 2f7014c598a900f828893aeb0c0724d9f48c37c6987dfc12847525df174e0e81.rtf
- Size 87KB
- Sample240724-btejsazeql
- SHA256 2f7014c598a900f828893aeb0c0724d9f48c37c6987dfc12847525df174e0e81
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2f7014c598a900f828893aeb0c0724d9f48c37c6987dfc12847525df174e0e81.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
CUSTOM.DIC
fb3b0dbfee58fac8.customDestinations-ms
memory/4884-6-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-16-0x00007FFF21910000-0x00007FFF21920000-memory.dmp
memory/4884-5-0x00007FFF6398D000-0x00007FFF6398E000-memory.dmp
memory/4884-7-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-0-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-10-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-14-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-13-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-15-0x00007FFF21910000-0x00007FFF21920000-memory.dmp
memory/4884-12-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-17-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-19-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-18-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-1-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-11-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-9-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-8-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-2-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-3-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-4-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-524-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp
memory/4884-547-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-546-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-549-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-548-0x00007FFF23970000-0x00007FFF23980000-memory.dmp
memory/4884-550-0x00007FFF638F0000-0x00007FFF63AE5000-memory.dmp