Analysis

  • max time kernel
    133s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2024 13:44

General

  • Target

    ~[INDONESIA] Counterdraft MoU on Rice Trade Indonesia-India 15052023.doc

  • Size

    560KB

  • MD5

    b1add667c8aaee23f02de4da3c921628

  • SHA1

    ab5fdffec59695d5a080f50937c4828e13d5a397

  • SHA256

    78ec064bce850d0e0a022cdbb84a6200e62f92e8e575ebbd4a9b764dc1dce771

  • SHA512

    69a677fccd5b8cb050da7a10a626b1b25d82771ac4db5d50ca38a7de48a56bc293f8ab14b62fa8f3cae4c69a407b715da4462bc667809ec92f544349b46bc587

  • SSDEEP

    12288:61mqdfL2MjgYpW6/CpSG9+bi/UdId/FJKuP1qi1ur5+LXmj/:6IqNbOCCKbUUkLqi1ur5R/

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~[INDONESIA] Counterdraft MoU on Rice Trade Indonesia-India 15052023.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDC78C.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

    Filesize

    12B

    MD5

    f6f801e5b0502f5e803ed826dd37ae44

    SHA1

    273e87aa518397186653443c0c3e81d574361708

    SHA256

    e7bcd23ba708556ee69f96050dc7e74f9dab95825bfab48bcea7fd8fac482fd1

    SHA512

    8fe0217b9c7f9331664dc4259c7924b9c7e5e145f0b795ec98d713e41a2e3d001014b3ac41071fe41447632ddbfbbefc8c7d6de8fa9faeca455a0a78575e5584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    7c2bfde7cf9d7c3650d5262a26c488fe

    SHA1

    cefc3e4897e2716d1d35806f8c89cdff02d0c4ba

    SHA256

    358b1f71568b2a3b4ef98bb8e9b78f04e8643cbd3afa289fd4915199bf9bdacc

    SHA512

    423211f0dd82089f811eb9d6860d7cb233137b20483a7787dbdb97af27c276abf71184b282cd3028ac35ee31697e34480b9a2d69a46d833cf9d77160500c62f5

  • memory/1616-11-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-19-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-1-0x00007FFFB4DD0000-0x00007FFFB4DE0000-memory.dmp

    Filesize

    64KB

  • memory/1616-9-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-0-0x00007FFFB4DD0000-0x00007FFFB4DE0000-memory.dmp

    Filesize

    64KB

  • memory/1616-12-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-13-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-14-0x00007FFFB2560000-0x00007FFFB2570000-memory.dmp

    Filesize

    64KB

  • memory/1616-15-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-16-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-18-0x00007FFFB2560000-0x00007FFFB2570000-memory.dmp

    Filesize

    64KB

  • memory/1616-17-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-20-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-5-0x00007FFFF4DED000-0x00007FFFF4DEE000-memory.dmp

    Filesize

    4KB

  • memory/1616-10-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-8-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-7-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-6-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-2-0x00007FFFB4DD0000-0x00007FFFB4DE0000-memory.dmp

    Filesize

    64KB

  • memory/1616-4-0x00007FFFB4DD0000-0x00007FFFB4DE0000-memory.dmp

    Filesize

    64KB

  • memory/1616-3-0x00007FFFB4DD0000-0x00007FFFB4DE0000-memory.dmp

    Filesize

    64KB

  • memory/1616-529-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-530-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-531-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB

  • memory/1616-532-0x00007FFFF4D50000-0x00007FFFF4F45000-memory.dmp

    Filesize

    2.0MB