Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 15:25

General

  • Target

    $PLUGINSDIR/Iminent_license.rtf

  • Size

    56KB

  • MD5

    f8578ff6185b661fe345208408091619

  • SHA1

    981078df6188ffc4566dda762df40cf6c19b4bd4

  • SHA256

    6936713a7d1a89e13b2d08038a5d5c5774d7611b218d2ba8da556efe28add6b5

  • SHA512

    b4229e80226bde268b2d847b9d0993d6a70a5b1f9eb44c8a225e1d0d035ca4b6a792d47ce9ab8b127b23e1d2fba75d9b502afb39ca98583d0eaa3d07c5508288

  • SSDEEP

    768:aE6m+kHbNZ/caU0MI6M1/caU0MI6Mn/caU0MI6MQ/caU0MI6Mvejq6CRFQ5/caU4:Nj/lb8W3YncXMYXip7LJKL9cO9

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Iminent_license.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD57AA.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    5KB

    MD5

    809142bd9624a0beaae26af403065744

    SHA1

    1f2fc4e1e4b37e71270365d0d2a1d2fe766018b7

    SHA256

    20730ad828c79e5d9ea3b39f9d10780debd952f6339478a4c348c10ce5e73250

    SHA512

    55150b333a0c550bd698c2a74fc3a25e11c1bc99be2ab0dcb8014985db86ff25e43d3176aa4d43a34c142f2aa31db3f7da5014b6c7b19023949b7bebf33f464e

  • memory/2800-12-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-183-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-6-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-5-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-9-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-10-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-16-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-15-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-17-0x00007FFFBB550000-0x00007FFFBB560000-memory.dmp

    Filesize

    64KB

  • memory/2800-14-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-13-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-18-0x00007FFFBB550000-0x00007FFFBB560000-memory.dmp

    Filesize

    64KB

  • memory/2800-2-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-0-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-4-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-8-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-7-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-32-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-33-0x00007FFFFD5CD000-0x00007FFFFD5CE000-memory.dmp

    Filesize

    4KB

  • memory/2800-34-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-35-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-3-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-1-0x00007FFFFD5CD000-0x00007FFFFD5CE000-memory.dmp

    Filesize

    4KB

  • memory/2800-11-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB

  • memory/2800-184-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-185-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-182-0x00007FFFBD5B0000-0x00007FFFBD5C0000-memory.dmp

    Filesize

    64KB

  • memory/2800-186-0x00007FFFFD530000-0x00007FFFFD725000-memory.dmp

    Filesize

    2.0MB