Analysis

  • max time kernel
    101s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 16:05

General

  • Target

    Kalkulator/B-517/obciążenia ładowni.doc

  • Size

    27KB

  • MD5

    0a4f46f45d61c857f5be7bc29980dec6

  • SHA1

    0ddc262c25637c8847f38d3c554f1055bb14e2ed

  • SHA256

    b8a2f4caa0a82b11b8dfa190ec7b20d7ed5686ceaa2ae8a43ed0b2850b80965a

  • SHA512

    1562465758853d3b48330ff84bb7056c1fb91d00a0f0d3724fa7c6d779c32ec8e2d4d87a3096332f5039e1706b53910e1e9c683f6dd81c36f39a591cf14f6e4a

  • SSDEEP

    96:Uy8ZVDGD1kks5tkP5Okb5Akmw5/kR5bkF5kkUkxL/3G3T3T3T3T3T3T3FNWgYEP6:uZVDo+MDhgwKDq+Z0dV

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Kalkulator\B-517\obciążenia ładowni.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD11E.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    2KB

    MD5

    fb48dceb7a03e3dfa92fe5f8c8517961

    SHA1

    963806923d2506967999ca471eb0c997847210bc

    SHA256

    2b69b45d2ee3b8e2fb1a000c2f82e28ef68ed5bccef93e3f36ecaf307d3f42a7

    SHA512

    4549fc21db6586b19b2275d0a0ac373191313299cab73893ce7f90487db53e2375b64f90686be26af385d41f16e87a7cec4f2f76a4245534b3ad5d834c0fac81

  • memory/1448-17-0x00007FF9D4890000-0x00007FF9D48A0000-memory.dmp

    Filesize

    64KB

  • memory/1448-13-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-1-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-0-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-9-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-8-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-10-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-7-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-11-0x00007FF9D4890000-0x00007FF9D48A0000-memory.dmp

    Filesize

    64KB

  • memory/1448-6-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-15-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-16-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-2-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-19-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-5-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-20-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-22-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-18-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-14-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-21-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-12-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-34-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-4-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-3-0x00007FFA1700D000-0x00007FFA1700E000-memory.dmp

    Filesize

    4KB

  • memory/1448-179-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-180-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-181-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-182-0x00007FF9D6FF0000-0x00007FF9D7000000-memory.dmp

    Filesize

    64KB

  • memory/1448-183-0x00007FFA16F70000-0x00007FFA17165000-memory.dmp

    Filesize

    2.0MB