Analysis
-
max time kernel
113s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
4db55b2df58083e75c9471d2b79e1f9edf9491f423313b4e125349fed3507227.rtf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4db55b2df58083e75c9471d2b79e1f9edf9491f423313b4e125349fed3507227.rtf
Resource
win10v2004-20240802-en
General
-
Target
4db55b2df58083e75c9471d2b79e1f9edf9491f423313b4e125349fed3507227.rtf
-
Size
1011KB
-
MD5
4d6c7b93c085f50060e99dba63ef5e27
-
SHA1
f67de698fd8eb036b8e83211880d1c449fe6f7e2
-
SHA256
4db55b2df58083e75c9471d2b79e1f9edf9491f423313b4e125349fed3507227
-
SHA512
e7f1c409b67a4070c16078037ecd1d2992543918bf728508bf610a2c1f3626ffbc0ea5efae92798765269f65a39ce7c11078a496f900e46df1a2b77eb21c3361
-
SSDEEP
6144:6wAYwA9WMyBtBWojqJnnR30lOGXdUz4+2:Bu
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3940 WINWORD.EXE 3940 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE 3940 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4db55b2df58083e75c9471d2b79e1f9edf9491f423313b4e125349fed3507227.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
18KB
MD52120059a5f4f31e3d618e765040c20a9
SHA12716e4564cb7052d352704abfa35c5171dbe4a8e
SHA2565ee9a2747516e7966591c6b5cf7e57adbab95d7cde580464da073b37d593328e
SHA51240b3d62f34043db9b558386e67d43a9593d7da54c97c6f8f1368ab7dd95fb57cc89990769707fbb0014cf14d364aef694c129d1ce132ed1185a884fde947dfcc
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84