Analysis
-
max time kernel
101s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-08-2024 01:31
General
-
Target
61f8e4e5644fe73fca16ac2bd69b9c4235510dbce70d1d7faf102134f869a2aa.docx
-
Size
84KB
-
MD5
4d1dda7b62796f1d78efc8081aed6e6a
-
SHA1
82bcec87e818bd0e56144c07c488bd063b27faad
-
SHA256
61f8e4e5644fe73fca16ac2bd69b9c4235510dbce70d1d7faf102134f869a2aa
-
SHA512
ca71010077f6337acf05e7badb6e8351e87aabdb98063f35cfdc0932767c0ebc56e74a93f72097cabfa13b2a1c37bb4dc16aa7e69518c31db067abb45a459f57
-
SSDEEP
1536:QItb7ih7kPw17kG1Tc2FjOpptOYN1TZhLdvV5brdSdA:QIt3ixkw17kcFOpptOYH99JV5brdSdA
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\61f8e4e5644fe73fca16ac2bd69b9c4235510dbce70d1d7faf102134f869a2aa.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD597f3291db00b29c1537f6faabfcf8983
SHA138ac80147123d212b5923160c7f29b93c25e885c
SHA2566f6e805c9473d6b4c0aec3b082cbc7e782b6c56a4d0048ef5902bb3ed8a8965c
SHA512ec3ccb5b3ab053968fa47048f6915de82e85bf1a4313eb479d34a9dbf4cd20ea059553c5f7407f8710da642f01356bc86411a10809575b286f43969d49a6cad0
-
Filesize
3KB
MD513d05fa49ce698401220226338e3db02
SHA1fc85534c4b31cbcc5b564b364f4e1c350ccfbffb
SHA256774d99709d25ef7d59676ae618bccdda580001e0ffe60bd163ef9b0fc897f0c4
SHA51279bc8e48cc0166ef17a3552edd6a24d1a6737b47d08776519e684852216cad78824e5debe447ce15fb228d83192d748f424cbe6657695a1c096ee5d21529d984
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
230B
MD5866fa5b828f548309d98688ea074d377
SHA1637cee85ab8ba27ba4062bc6c3492516bdfcbea1
SHA256a084447f894a5040db5f15fa4a47f3c30adf739effe73f9a44194b9e79526b36
SHA512355f15cf77c01bd1c2f8831ce43bf2df722a635e040fc426f7af7b6996992f9a388d35da2c659bd128ceaf7ec569320f090f3f8b26ba8f1561001c182bb9b606
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB