Analysis

  • max time kernel
    47s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 21:15

General

  • Target

    773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5.docx

  • Size

    141KB

  • MD5

    584410ce253da7a7a165233ca100ca83

  • SHA1

    4be0e18e971f0c8443aba983826312f1a9103f0a

  • SHA256

    773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5

  • SHA512

    66555af131b8d9474bc3db81227b3ef4e74a7b3bc678b5715a54b52017d99f266729cbc2358425d09bcded014f6682633d30f2e1122a140faa54527c221348ae

  • SSDEEP

    3072:nHjiNnE9xcCSbQcFyjZ9p7p6+1Ghfu+uUsw8Okcf:HedEFSbQ4gZ939Ou+uUsw7ki

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D2418591.emf

    Filesize

    16KB

    MD5

    767d8595d67d70f6c19ed869df119765

    SHA1

    8ceb76d98dde5e69bf541623ec5ac6f034e6edb8

    SHA256

    8a05aef60aa3ca524164d3c1c0ac369a2b42d00293b33533cfce3d5576877ef8

    SHA512

    794ce1be4440925efad4aa7823af3eca8b891109118a5e09414fc5a14e310db8af316d3e552ba22dac9bd0bd692f00955616cfdaec21c872f0a9377f3c61fc21

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\opningnewthingstobegreatattitudewithentirethingstogoreturrnwithallnewmanufacturesarehere________greatwayofreturnhim[1].doc

    Filesize

    92KB

    MD5

    7da751285a673c1b6b0459614a411267

    SHA1

    a340c1b262b48dd4b1726fab58b304de0c258acd

    SHA256

    ae69a637db88457f0e6f1b67e2f3b55b88bd95af602f4b1afe7dffc617593f2b

    SHA512

    948e0702adbbd5424a8cda0b246d52f45b642745a39a04708527d0968b3481c181b380d86040200508ae77d4fcaeb9ea6745f8568b375425f5ff0d8ab82074d9

  • C:\Users\Admin\AppData\Local\Temp\TCD691.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    335B

    MD5

    dd737a3b208e4baddf5b512e75e5dbf1

    SHA1

    fbc1eb011a24c3da195099dd4715eb6eba1c2a37

    SHA256

    70a4d7fe78f786617d56d55ae2a3bc34fc71850ad70d9e1a59b35e2543e03653

    SHA512

    67a662c07a3ce99b6f28f3038fca69f6e78e56e7f015e0f81c3d3eb4593fdcb5cbcfd353784da53b0e8e939bfccfdfc136999d215252b2d0e78adea51b824157

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    cc3214c11fe0763826d87ec4821695b6

    SHA1

    9b4bd90e8ef195e6a822728bb7ee951dea46f8d1

    SHA256

    1afe223944abfd69064b31de835265a88de0aa831b213cc714896787155c1b3e

    SHA512

    d184414db93b4744f691abf9656113cbe85fd4f6abd0a722484034e34ca9a195b1a70745b6c041c06b882fc5ac1da4f54ad263fb829b131d5a5739c26c6fc10d

  • memory/4792-21-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-17-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-13-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-14-0x00007FF965280000-0x00007FF965290000-memory.dmp

    Filesize

    64KB

  • memory/4792-10-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-9-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-16-0x00007FF965280000-0x00007FF965290000-memory.dmp

    Filesize

    64KB

  • memory/4792-20-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-0-0x00007FF967730000-0x00007FF967740000-memory.dmp

    Filesize

    64KB

  • memory/4792-19-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-18-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-11-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-15-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-8-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-7-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-6-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-12-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-3-0x00007FF967730000-0x00007FF967740000-memory.dmp

    Filesize

    64KB

  • memory/4792-4-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp

    Filesize

    4KB

  • memory/4792-5-0x00007FF967730000-0x00007FF967740000-memory.dmp

    Filesize

    64KB

  • memory/4792-1-0x00007FF967730000-0x00007FF967740000-memory.dmp

    Filesize

    64KB

  • memory/4792-99-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4792-2-0x00007FF967730000-0x00007FF967740000-memory.dmp

    Filesize

    64KB