Analysis
-
max time kernel
100s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 10:47
General
-
Target
Order list.docx
-
Size
264KB
-
MD5
4115f6dbb0506ef0d0456fb5af4d15e3
-
SHA1
4a60662c298bb379b0caf6f01ba4d008dc26d47c
-
SHA256
5de1378264acf7c2476c921237f77e32cce1db126ef09e9ff7ff9c2d65492892
-
SHA512
303c47aae9ebf90278cefa92876526baeceee257a18d2540b629700229b4dd88065ce8b0161a9d7d84c1f46fefebf2835369deb67fa935c5084c798a81145d3f
-
SSDEEP
6144:IOu2KODqCLYDJQGhFT+2diEFyhieKnymDX:I52KoqMYDfhR+6EiXyE
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order list.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5082e8fbe73d98fd6c861150ef1fc0905
SHA1c91eccf6c9a73b74d9d1442eb72a8d6f650edc64
SHA256574ef96fef6b764d4047bb2d714ab5d753ec81e87bc9f5ad1526db74446e3b13
SHA512afee4534199071801e19ae9d8e57b396989746e3f9d7081337b85b4b2108625849364bd04afba41261cc731bd54a83d8269a5ef74ee1878b157628c34240e751
-
Filesize
97KB
MD52db98a27e71fef64135ce5e259d5a8c4
SHA1c56c7928e5be5938ca7d958ebb03d3544b05ecdb
SHA256a237c08add2ea84614fdf51181abd922b15e53b01673b06509578f4e3ba301bd
SHA51264c1abcb9304ee96bedca9bcafaa29f2be0c0cdcf08cab69e0b11531e16e612ab8f451e8259cebd55c2d4e4e12565912b5579b61102f1cebea97f5bd58cd2cf9
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
300B
MD5e49fe4d6705bee9270eee3788881882b
SHA1a0e60ce0ac94018b6319970e10b8171feddb555c
SHA256f40a311617833f79c67433699791bff7a50ebb4da7ce0e7e960a2370c11e24d7
SHA512d1589131ef75de92630a8ebeb05fd7a5aee7778cae981697046dc11a5673aca8346beb1f932e8b3c922f847446969dd03c7f256776eba630508f054bc4cd2322
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB