Analysis
-
max time kernel
47s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/08/2024, 21:15
General
-
Target
773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5.docx
-
Size
141KB
-
MD5
584410ce253da7a7a165233ca100ca83
-
SHA1
4be0e18e971f0c8443aba983826312f1a9103f0a
-
SHA256
773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5
-
SHA512
66555af131b8d9474bc3db81227b3ef4e74a7b3bc678b5715a54b52017d99f266729cbc2358425d09bcded014f6682633d30f2e1122a140faa54527c221348ae
-
SSDEEP
3072:nHjiNnE9xcCSbQcFyjZ9p7p6+1Ghfu+uUsw8Okcf:HedEFSbQ4gZ939Ou+uUsw7ki
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\773a761f49964da9e1f9432fd912864ce070cd96b3686024ce03571fb22647a5.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5767d8595d67d70f6c19ed869df119765
SHA18ceb76d98dde5e69bf541623ec5ac6f034e6edb8
SHA2568a05aef60aa3ca524164d3c1c0ac369a2b42d00293b33533cfce3d5576877ef8
SHA512794ce1be4440925efad4aa7823af3eca8b891109118a5e09414fc5a14e310db8af316d3e552ba22dac9bd0bd692f00955616cfdaec21c872f0a9377f3c61fc21
-
Filesize
92KB
MD57da751285a673c1b6b0459614a411267
SHA1a340c1b262b48dd4b1726fab58b304de0c258acd
SHA256ae69a637db88457f0e6f1b67e2f3b55b88bd95af602f4b1afe7dffc617593f2b
SHA512948e0702adbbd5424a8cda0b246d52f45b642745a39a04708527d0968b3481c181b380d86040200508ae77d4fcaeb9ea6745f8568b375425f5ff0d8ab82074d9
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
335B
MD5dd737a3b208e4baddf5b512e75e5dbf1
SHA1fbc1eb011a24c3da195099dd4715eb6eba1c2a37
SHA25670a4d7fe78f786617d56d55ae2a3bc34fc71850ad70d9e1a59b35e2543e03653
SHA51267a662c07a3ce99b6f28f3038fca69f6e78e56e7f015e0f81c3d3eb4593fdcb5cbcfd353784da53b0e8e939bfccfdfc136999d215252b2d0e78adea51b824157
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
1KB
MD5cc3214c11fe0763826d87ec4821695b6
SHA19b4bd90e8ef195e6a822728bb7ee951dea46f8d1
SHA2561afe223944abfd69064b31de835265a88de0aa831b213cc714896787155c1b3e
SHA512d184414db93b4744f691abf9656113cbe85fd4f6abd0a722484034e34ca9a195b1a70745b6c041c06b882fc5ac1da4f54ad263fb829b131d5a5739c26c6fc10d
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB