Analysis

  • max time kernel
    124s
  • max time network
    154s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-08-2024 01:25

General

  • Target

    resources/app.asar.unpacked/node_modules/node-notifier/vendor/mac.noindex/terminal-notifier.app/Cont.rtf

  • Size

    465B

  • MD5

    6e2bc43c0e87081ccf9fc2edfe8589b7

  • SHA1

    31250e2ae7011adf5d1268de756681c867cba03c

  • SHA256

    f2567d456578b1e500092eea27fa3da7c7df9bfcb915fd7575e3b7cbd6ce3a7d

  • SHA512

    27e7356c3e92cb6271bffd43616fb1152ad7dfb40037058ba2499b9216033e5adee2525c86e2e0ddbe7c3e389e0f67de1ff0b3db5752d714a3466fc128ba7ba2

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Cont.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD2A06.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • memory/2908-29-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-4-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-30-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-0-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-5-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-6-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-7-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-10-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-11-0x00007FFE06E20000-0x00007FFE06E30000-memory.dmp

    Filesize

    64KB

  • memory/2908-12-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-13-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-14-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-15-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-16-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-17-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-18-0x00007FFE06E20000-0x00007FFE06E30000-memory.dmp

    Filesize

    64KB

  • memory/2908-3-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-32-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-2-0x00007FFE4A8E5000-0x00007FFE4A8E6000-memory.dmp

    Filesize

    4KB

  • memory/2908-34-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-33-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-31-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-28-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-27-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-191-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-192-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-193-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-194-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-195-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-1-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-744-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-745-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-743-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-746-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

    Filesize

    64KB

  • memory/2908-747-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB

  • memory/2908-748-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

    Filesize

    1.9MB