Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    15-09-2024 21:15

General

  • Target

    0cef17ba672793d8e32216240706cf46e3a2894d0e558906a1782405a8f4decf.docm

  • Size

    93KB

  • MD5

    e745d9bb0dd69f151afea9eadc808711

  • SHA1

    8b2b5cfc6ffc976a51059a84e020d9459e870bfd

  • SHA256

    0cef17ba672793d8e32216240706cf46e3a2894d0e558906a1782405a8f4decf

  • SHA512

    bfcd2c4b25a5331b43d0f858ed24b834bbfc6ca13b00d71b161efeb2dc31f66b52d907145ad6c0d5663e0a3baf7dbdb537ac8865ecbff53d297640a4fc6ba8b9

  • SSDEEP

    1536:SwYn0lfu/j5Q0KWn1o6DB+ZbuRqcwoDZc4+bhwTd81tlrJVhfIGgdqVw2X8Qr374:SwY0lo1QG1FDFpZabhwTIXvNjgEW2XxY

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0cef17ba672793d8e32216240706cf46e3a2894d0e558906a1782405a8f4decf.docm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD4ABE.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    0070101800e4d98195d1d8d72f60ea7e

    SHA1

    b2b9b57e919e075c6cb43304661114eafba171d1

    SHA256

    aaba12fd92f88ee169822d479e095cd6fdd92cb742fdd0dae236d58ebe354392

    SHA512

    5a388d2c5804ae48fef0762962ccbe61b47db4d4fea9bcbf2bf1d5d812a934ac7329477c01cbce14466bdf5cf6eb312fd8fe7cecdef77aec22251ae801e628d4

  • memory/1120-11-0x00007FFBA3560000-0x00007FFBA3570000-memory.dmp

    Filesize

    64KB

  • memory/1120-66-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-6-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-5-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-4-0x00007FFBA5BF0000-0x00007FFBA5C00000-memory.dmp

    Filesize

    64KB

  • memory/1120-7-0x00007FFBA5BF0000-0x00007FFBA5C00000-memory.dmp

    Filesize

    64KB

  • memory/1120-9-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-10-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-8-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-13-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-12-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-14-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-0-0x00007FFBA5BF0000-0x00007FFBA5C00000-memory.dmp

    Filesize

    64KB

  • memory/1120-2-0x00007FFBA5BF0000-0x00007FFBA5C00000-memory.dmp

    Filesize

    64KB

  • memory/1120-47-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-15-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-46-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-45-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-17-0x00007FFBA3560000-0x00007FFBA3570000-memory.dmp

    Filesize

    64KB

  • memory/1120-53-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-54-0x00007FFBE5C0D000-0x00007FFBE5C0E000-memory.dmp

    Filesize

    4KB

  • memory/1120-55-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-56-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-57-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-3-0x00007FFBA5BF0000-0x00007FFBA5C00000-memory.dmp

    Filesize

    64KB

  • memory/1120-16-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-67-0x00007FFBE5B70000-0x00007FFBE5D65000-memory.dmp

    Filesize

    2.0MB

  • memory/1120-1-0x00007FFBE5C0D000-0x00007FFBE5C0E000-memory.dmp

    Filesize

    4KB