Analysis

  • max time kernel
    113s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2024 18:32

General

  • Target

    d63c7600ca42fe65af91ae662ef7b637.rtf

  • Size

    78KB

  • MD5

    d63c7600ca42fe65af91ae662ef7b637

  • SHA1

    6f8bba7b9751ed550d0bd7f6f29e7229888ad6f9

  • SHA256

    eb0786d23a2ada26a937a41d56a96514a3df0027ff857d0407d462adfba18ddb

  • SHA512

    83f20a16b336f08d817bc427b39a62a0957ec4bf481b10a320e184c378e227fc2bae513245a18c056fdd34e53f0e6b192f6ca2cb16ad0ca123fdd2938dd58427

  • SSDEEP

    384:vnHdoOarkwlJbmbKLY17V/W7ZftG5eqVdwRQb65Y2zdfGxswDRa:vnHmOarkwTzs174geqVCFux7a

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d63c7600ca42fe65af91ae662ef7b637.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDDD97.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    e90b0b02e7fe05724eded1c318473b54

    SHA1

    2f89d3245e1577acedb8b18976714e4c7e9b0aea

    SHA256

    c84ccd4890c9a0cdcb8670baf01510dfbfff6fb191e34179d922f07950382e9a

    SHA512

    4e6d3c54114136ccbeabd60f3095c8fb664233c1c67e3e2fd41e1842b2d6478dd1f61a962c038ed556ec05bb4e14b0c4c7186ed1c393cfd03c9c0540e9a2d3d4

  • memory/3412-20-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-4-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-16-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-5-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-6-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-9-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-13-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-14-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-12-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-11-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-15-0x00007FFCA3970000-0x00007FFCA3980000-memory.dmp

    Filesize

    64KB

  • memory/3412-17-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-19-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-18-0x00007FFCA3970000-0x00007FFCA3980000-memory.dmp

    Filesize

    64KB

  • memory/3412-188-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-2-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-10-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-8-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-7-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-34-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-35-0x00007FFCE5A8D000-0x00007FFCE5A8E000-memory.dmp

    Filesize

    4KB

  • memory/3412-36-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-37-0x00007FFCE59F0000-0x00007FFCE5BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3412-3-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-0-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-185-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-186-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-187-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-184-0x00007FFCA5A70000-0x00007FFCA5A80000-memory.dmp

    Filesize

    64KB

  • memory/3412-1-0x00007FFCE5A8D000-0x00007FFCE5A8E000-memory.dmp

    Filesize

    4KB