Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
ORDER CFC.docx
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ORDER CFC.docx
Resource
win10v2004-20240802-en
General
-
Target
ORDER CFC.docx
-
Size
179KB
-
MD5
413ed50fc5b7fc796c710bb1b0f02cc4
-
SHA1
440c50be71fbe20648115bcd65b04a75940a833a
-
SHA256
dcdd3c117ec0dc6af052496d1cc0d24da9b264f566e0e763380af879dfbcdf27
-
SHA512
c47893f5b8cca2015ff4803d14dc8f04d857ee0478d62be8dd61f00d0e363de1c1c05b16cde5afe9d0ed0a2df58fada5deda7b728f65f2b20764df430f787d99
-
SSDEEP
3072:AiY5rj1ATug+mhTZMxjcFQ9csn4qAzYjDp/shKuikycBSRjR/Vx7XUo4Zj:a5r/g+qZMpcFSQzYHut4dNAj
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3076 WINWORD.EXE 3076 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeAuditPrivilege 3076 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3076 WINWORD.EXE 3076 WINWORD.EXE 3076 WINWORD.EXE 3076 WINWORD.EXE 3076 WINWORD.EXE 3076 WINWORD.EXE 3076 WINWORD.EXE 3076 WINWORD.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER CFC.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD577d04e68c46c843c399d83b858b9b46a
SHA18f4f41f26cd7bd6b60045cc878c83d132f79193a
SHA256d718eb322dc9348cb1813a920ca739a5c4bd6b44ac32c0c085bd92148bf94161
SHA51222986daa2bd352305885276d9c000caf89c171a6187caadb1d29bbbf1e89916e4a6a199aa6500890befaa9dfc92a14d87976b470b41ec49f5f050b40f9b8b81d
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
364B
MD562c9af5ac082b66a7d18ceba044930a8
SHA1b9ee17f314b7144fba48b6cfcac16a771f27a46b
SHA256bdad9f7c432ea6aaf68639a0b4f995347fe196d436e20a1db8bfee55002a7250
SHA5120d500fa8459655ba751b02c91a980ab49369a0e1a821ed8440474218f4d5364030582e2c8af9a964d37ea661d49b253d50394425ec7861ac58b8743cbfe2a7b8
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD5381b42c3b396bdde45d078d2165feca5
SHA18b9b4bf3eff6122ef0b6b32634281116bea7618a
SHA256956d7b291050a6a71b48ad9f9691aeed6d91fb95047c30562b109e04fa2b143e
SHA512e87d336961967f278485508ec8286d757b588089331231bb439453236e0a73d1827de594983d452cb9133469f408133ae421875dbb5a604aea8a75f2537b403b