Overview
overview
3Static
static
1asm/pptok.pl
windows10-2004-x64
3asm/tokhash.pl
windows10-2004-x64
3autoconf/clean.sh
windows10-2004-x64
3autoconf/h....guess
windows10-2004-x64
3autoconf/h...ig.sub
windows10-2004-x64
3autoconf/h...all-sh
windows10-2004-x64
1autoconf/unconfig.pl
windows10-2004-x64
3autogen.sh
windows10-2004-x64
3configure.vbs
windows10-2004-x64
1doc/afmmetrics.ph
windows10-2004-x64
3doc/findfont.ph
windows10-2004-x64
3doc/genps.pl
windows10-2004-x64
3doc/inslist.pl
windows10-2004-x64
3doc/internal.doc
windows10-2004-x64
1doc/psfonts.ph
windows10-2004-x64
3doc/pspdf.pl
windows10-2004-x64
3doc/pswidth.ph
windows10-2004-x64
3doc/rdsrc.pl
windows10-2004-x64
3doc/ttfmetrics.ph
windows10-2004-x64
3misc/emacstbl.pl
windows10-2004-x64
3misc/fmtinsns.pl
windows10-2004-x64
3misc/genfma.pl
windows10-2004-x64
3misc/pmw.bat
windows10-2004-x64
1nasmlib/perfhash.pl
windows10-2004-x64
3nsis/NASMM...er.ps1
windows10-2004-x64
3nsis/getpearch.pl
windows10-2004-x64
3perllib/gensv.pl
windows10-2004-x64
3test/bisect.sh
windows10-2004-x64
3test/iftoken.pl
windows10-2004-x64
3test/new
windows10-2004-x64
1test/perf/label.pl
windows10-2004-x64
3test/riprel.pl
windows10-2004-x64
3Analysis
-
max time kernel
1328s -
max time network
1155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
asm/pptok.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
asm/tokhash.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
autoconf/clean.sh
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
autoconf/helpers/config.guess
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
autoconf/helpers/config.sub
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
autoconf/helpers/install-sh
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
autoconf/unconfig.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
autogen.sh
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
configure.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
doc/afmmetrics.ph
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
doc/findfont.ph
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
doc/genps.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
doc/inslist.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
doc/internal.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
doc/psfonts.ph
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
doc/pspdf.pl
Resource
win10v2004-20240910-en
Behavioral task
behavioral17
Sample
doc/pswidth.ph
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
doc/rdsrc.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
doc/ttfmetrics.ph
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
misc/emacstbl.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
misc/fmtinsns.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
misc/genfma.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
misc/pmw.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
nasmlib/perfhash.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
nsis/NASMMultiUser.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
nsis/getpearch.pl
Resource
win10v2004-20240910-en
Behavioral task
behavioral27
Sample
perllib/gensv.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
test/bisect.sh
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
test/iftoken.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
test/new
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
test/perf/label.pl
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
test/riprel.pl
Resource
win10v2004-20240802-en
General
-
Target
doc/internal.doc
-
Size
11KB
-
MD5
14945570fdbe0947ae82e377dcca536d
-
SHA1
8777dd8531937d22b236b5b6f05acb54f2c54c78
-
SHA256
6780d5d89a60b563610eefb615c6a0ce89642b34c49363837b70e5fba2208ae8
-
SHA512
3d349f26be35f9e4cbbb2feecd84151fc7cbc3d589369ca6d3d5071127cf65368fc79d3de16563e04a756f11407c93bd3b9ba2b214521296aed95d8241dc8ef8
-
SSDEEP
192:PQnx4zS5STgnjSR0t1kmyWYKS5weupGSbkld/vGarUG8A/BqHABXotrG2HUNqm+f:E4zS5SkeR0nkmyWkqB7bk33xrdnBqHAy
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4944 WINWORD.EXE 4944 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE 4944 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc\internal.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5fada0eb649bb0c9a290ea0fc59dd6b45
SHA1166ad2b14610276478b2fad178b3d5e07b75a316
SHA2563321d414e854f4d889521135279d79699c62701ea9fbd908ec14ff3fbacff8e5
SHA512184076998131d9ebda3a6f57d8839698dc20895ef0a9dc4d71a00acd73137a4881318798ab8d3812109c7cf988e6c2137f13327ab0823ac314a2d12be10bf5a7