Analysis

  • max time kernel
    1328s
  • max time network
    1155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 15:54

General

  • Target

    doc/internal.doc

  • Size

    11KB

  • MD5

    14945570fdbe0947ae82e377dcca536d

  • SHA1

    8777dd8531937d22b236b5b6f05acb54f2c54c78

  • SHA256

    6780d5d89a60b563610eefb615c6a0ce89642b34c49363837b70e5fba2208ae8

  • SHA512

    3d349f26be35f9e4cbbb2feecd84151fc7cbc3d589369ca6d3d5071127cf65368fc79d3de16563e04a756f11407c93bd3b9ba2b214521296aed95d8241dc8ef8

  • SSDEEP

    192:PQnx4zS5STgnjSR0t1kmyWYKS5weupGSbkld/vGarUG8A/BqHABXotrG2HUNqm+f:E4zS5SkeR0nkmyWkqB7bk33xrdnBqHAy

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc\internal.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDDEB0.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    fada0eb649bb0c9a290ea0fc59dd6b45

    SHA1

    166ad2b14610276478b2fad178b3d5e07b75a316

    SHA256

    3321d414e854f4d889521135279d79699c62701ea9fbd908ec14ff3fbacff8e5

    SHA512

    184076998131d9ebda3a6f57d8839698dc20895ef0a9dc4d71a00acd73137a4881318798ab8d3812109c7cf988e6c2137f13327ab0823ac314a2d12be10bf5a7

  • memory/4944-7-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-551-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-4-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-6-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-5-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-0-0x00007FFC3732D000-0x00007FFC3732E000-memory.dmp

    Filesize

    4KB

  • memory/4944-8-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-10-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-11-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-12-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-13-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-29-0x00007FFC3732D000-0x00007FFC3732E000-memory.dmp

    Filesize

    4KB

  • memory/4944-2-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-14-0x00007FFBF4D30000-0x00007FFBF4D40000-memory.dmp

    Filesize

    64KB

  • memory/4944-9-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-30-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-31-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-32-0x000001CC04AA0000-0x000001CC04ACC000-memory.dmp

    Filesize

    176KB

  • memory/4944-33-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB

  • memory/4944-3-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-1-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-550-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-549-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-552-0x00007FFBF7310000-0x00007FFBF7320000-memory.dmp

    Filesize

    64KB

  • memory/4944-15-0x00007FFBF4D30000-0x00007FFBF4D40000-memory.dmp

    Filesize

    64KB

  • memory/4944-553-0x000001CC04AA0000-0x000001CC04ACC000-memory.dmp

    Filesize

    176KB

  • memory/4944-554-0x00007FFC37290000-0x00007FFC37485000-memory.dmp

    Filesize

    2.0MB