Resubmissions
24/07/2024, 13:54
240724-q7tm7ascrf124/07/2024, 12:25
240724-plt66ayelb624/07/2024, 11:31
240724-nm2rystgrm7Analysis
- max time kernel
529s - max time network
444s - platform
windows11-21h2_x64 - resource
win11-20240709-en - resource tags
- submitted
24/07/2024, 13:54
General
- Target Notebooks/Groneweg Gruppe Investment Portfolio/Groneweg Gruppe Investment Portfolio.one
- Size 141KB
- Sample240724-q7tm7ascrf
- SHA256 f284da4e28e423659cf358270e081d402cbf853030abd01fd655fa9d4d2533f1
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\Notebooks\Groneweg Gruppe Investment Portfolio\Groneweg Gruppe Investment Portfolio.one"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
000000BQ.bin
{23AB1317-8C5D-4955-98FD-AF847F9CEB90}.bin
{8BA6BDED-BD93-4632-A5CD-BDE19B2DE594}.bin
ExcludeDictionaryEN0409.lex
memory/5012-14-0x00007FFB2A9B0000-0x00007FFB2A9C0000-memory.dmp
memory/5012-15-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-8-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-7-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-6-0x00007FFB2CBD0000-0x00007FFB2CBE0000-memory.dmp
memory/5012-9-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-11-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-10-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-0-0x00007FFB2CBD0000-0x00007FFB2CBE0000-memory.dmp
memory/5012-13-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-12-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-5-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-16-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-20-0x00007FFB2A9B0000-0x00007FFB2A9C0000-memory.dmp
memory/5012-19-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-21-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-18-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-17-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp
memory/5012-3-0x00007FFB6CBE3000-0x00007FFB6CBE4000-memory.dmp
memory/5012-4-0x00007FFB2CBD0000-0x00007FFB2CBE0000-memory.dmp
memory/5012-1-0x00007FFB2CBD0000-0x00007FFB2CBE0000-memory.dmp
memory/5012-2-0x00007FFB2CBD0000-0x00007FFB2CBE0000-memory.dmp
memory/5012-75-0x00007FFB6CB40000-0x00007FFB6CD49000-memory.dmp