Analysis
-
max time kernel
47s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 21:07
Static task
static1
Behavioral task
behavioral1
Sample
c024b3ce1e4e0f64f534e5be9674590167a2020181169589448f46d76e62f8d5.doc
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c024b3ce1e4e0f64f534e5be9674590167a2020181169589448f46d76e62f8d5.doc
Resource
win10v2004-20240802-en
General
-
Target
c024b3ce1e4e0f64f534e5be9674590167a2020181169589448f46d76e62f8d5.doc
-
Size
263KB
-
MD5
53a18afd1fbce99badcee9c314304042
-
SHA1
03d565e445cd15c3093b371506a92e0177e7f467
-
SHA256
c024b3ce1e4e0f64f534e5be9674590167a2020181169589448f46d76e62f8d5
-
SHA512
13d5941e77c9c1daf6b5a2d2c5481a6791e06757193c500003af80dcee14a1b882a49846fb750a4093933fc23e6dc7c170660625624643893f9da5966c5657bf
-
SSDEEP
6144:aP/oNCf2uCzQY6izYFYxYWYzvzpYHYz2zMYNzzunOOPnInMnKn+nvunWlnw1PwTk:nYZPXxSVzIMy8p9
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5020 WINWORD.EXE 5020 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE 5020 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c024b3ce1e4e0f64f534e5be9674590167a2020181169589448f46d76e62f8d5.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5fbb3be805572963034f40ed089e2611d
SHA1e31412d3d7a5c0b1e3c66a891d257f187f0c038a
SHA2561a92a796935ad2caa75b83737856e311023696af0251f6076b2db8a0e4eb78e7
SHA512d49874105b448f5d3581c03a65c13fc22e232c625e51a0a47dfc67e82e2555b223fb27512ea4aa4016b20e70e825045bf4cfd57bc82dc06002d4f1bec4c8c08b