Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 07:16

General

  • Target

    ORDER CFC.docx

  • Size

    179KB

  • MD5

    413ed50fc5b7fc796c710bb1b0f02cc4

  • SHA1

    440c50be71fbe20648115bcd65b04a75940a833a

  • SHA256

    dcdd3c117ec0dc6af052496d1cc0d24da9b264f566e0e763380af879dfbcdf27

  • SHA512

    c47893f5b8cca2015ff4803d14dc8f04d857ee0478d62be8dd61f00d0e363de1c1c05b16cde5afe9d0ed0a2df58fada5deda7b728f65f2b20764df430f787d99

  • SSDEEP

    3072:AiY5rj1ATug+mhTZMxjcFQ9csn4qAzYjDp/shKuikycBSRjR/Vx7XUo4Zj:a5r/g+qZMpcFSQzYHut4dNAj

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ORDER CFC.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3076

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GENTSNHI\lOpkseAloegPhxxAcv[1].doc

          Filesize

          820KB

          MD5

          77d04e68c46c843c399d83b858b9b46a

          SHA1

          8f4f41f26cd7bd6b60045cc878c83d132f79193a

          SHA256

          d718eb322dc9348cb1813a920ca739a5c4bd6b44ac32c0c085bd92148bf94161

          SHA512

          22986daa2bd352305885276d9c000caf89c171a6187caadb1d29bbbf1e89916e4a6a199aa6500890befaa9dfc92a14d87976b470b41ec49f5f050b40f9b8b81d

        • C:\Users\Admin\AppData\Local\Temp\TCDFCA3.tmp\iso690.xsl

          Filesize

          263KB

          MD5

          ff0e07eff1333cdf9fc2523d323dd654

          SHA1

          77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

          SHA256

          3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

          SHA512

          b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

          Filesize

          364B

          MD5

          62c9af5ac082b66a7d18ceba044930a8

          SHA1

          b9ee17f314b7144fba48b6cfcac16a771f27a46b

          SHA256

          bdad9f7c432ea6aaf68639a0b4f995347fe196d436e20a1db8bfee55002a7250

          SHA512

          0d500fa8459655ba751b02c91a980ab49369a0e1a821ed8440474218f4d5364030582e2c8af9a964d37ea661d49b253d50394425ec7861ac58b8743cbfe2a7b8

        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

          Filesize

          16B

          MD5

          d29962abc88624befc0135579ae485ec

          SHA1

          e40a6458296ec6a2427bcb280572d023a9862b31

          SHA256

          a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

          SHA512

          4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          2KB

          MD5

          381b42c3b396bdde45d078d2165feca5

          SHA1

          8b9b4bf3eff6122ef0b6b32634281116bea7618a

          SHA256

          956d7b291050a6a71b48ad9f9691aeed6d91fb95047c30562b109e04fa2b143e

          SHA512

          e87d336961967f278485508ec8286d757b588089331231bb439453236e0a73d1827de594983d452cb9133469f408133ae421875dbb5a604aea8a75f2537b403b

        • memory/3076-4-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-16-0x00007FFE25F70000-0x00007FFE25F80000-memory.dmp

          Filesize

          64KB

        • memory/3076-0-0x00007FFE6824D000-0x00007FFE6824E000-memory.dmp

          Filesize

          4KB

        • memory/3076-10-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-9-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-8-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-12-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-13-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-14-0x00007FFE25F70000-0x00007FFE25F80000-memory.dmp

          Filesize

          64KB

        • memory/3076-11-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-15-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-7-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-27-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-28-0x00007FFE6824D000-0x00007FFE6824E000-memory.dmp

          Filesize

          4KB

        • memory/3076-6-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-5-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB

        • memory/3076-2-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-3-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-1-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-229-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-228-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-231-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-230-0x00007FFE28230000-0x00007FFE28240000-memory.dmp

          Filesize

          64KB

        • memory/3076-232-0x00007FFE681B0000-0x00007FFE683A5000-memory.dmp

          Filesize

          2.0MB