Overview
overview
10Static
static
1000ab8a1a2b...51.doc
windows7-x64
300ab8a1a2b...51.doc
windows10-2004-x64
104bbbaf0d0...25.exe
windows7-x64
304bbbaf0d0...25.exe
windows10-2004-x64
31139a9099f...64.exe
windows7-x64
31139a9099f...64.exe
windows10-2004-x64
3114a8c03ee...39.doc
windows7-x64
4114a8c03ee...39.doc
windows10-2004-x64
119911c6865...fc.exe
windows7-x64
19911c6865...fc.exe
windows10-2004-x64
2299ff9c7e...6.docx
windows7-x64
42299ff9c7e...6.docx
windows10-2004-x64
12b79b44b0f...07.dll
windows7-x64
52b79b44b0f...07.dll
windows10-2004-x64
52c6638998f...2a.xls
windows7-x64
32c6638998f...2a.xls
windows10-2004-x64
135352a7ac7...ce.exe
windows7-x64
35352a7ac7...ce.exe
windows10-2004-x64
3792408618...3f.xls
windows7-x64
33792408618...3f.xls
windows10-2004-x64
13b0fd96950...ea.dll
windows7-x64
53b0fd96950...ea.dll
windows10-2004-x64
54078c6d0ff...f7.lnk
windows7-x64
34078c6d0ff...f7.lnk
windows10-2004-x64
7428f4ed31c...99.dll
windows7-x64
1428f4ed31c...99.dll
windows10-2004-x64
14c27f9a78c...04.ps1
windows7-x64
34c27f9a78c...04.ps1
windows10-2004-x64
34d9f557790...24.exe
windows7-x64
74d9f557790...24.exe
windows10-2004-x64
74f7848518a...6d.doc
windows7-x64
34f7848518a...6d.doc
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2024 18:16
Behavioral task
behavioral1
Sample
00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
04bbbaf0d059bb09a2e44a3dbadb391a2f5aab5bfef5718fa3e8198502d0eb25.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
04bbbaf0d059bb09a2e44a3dbadb391a2f5aab5bfef5718fa3e8198502d0eb25.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
1139a9099f0424b533a49c8bc4ac5d569e67db11ff5fd02c8552a3461db7ba64.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
1139a9099f0424b533a49c8bc4ac5d569e67db11ff5fd02c8552a3461db7ba64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
19911c686578bafabd45a1e491333f1e0bc5eac5f6b1db29aa913dfd3dd207fc.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
19911c686578bafabd45a1e491333f1e0bc5eac5f6b1db29aa913dfd3dd207fc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
35352a7ac72a7962744268c134b1aacaba3eccd700e5c1378b4c13cf08d353ce.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
35352a7ac72a7962744268c134b1aacaba3eccd700e5c1378b4c13cf08d353ce.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
3792408618099db73b654704b12c9520d3267c37e50bf9718c2877ec2e65133f.xls
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
3792408618099db73b654704b12c9520d3267c37e50bf9718c2877ec2e65133f.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
3b0fd96950336e30d3586c719ad802d89668276fbc7d7209c8d8bf4e59eb6bea.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
3b0fd96950336e30d3586c719ad802d89668276fbc7d7209c8d8bf4e59eb6bea.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
428f4ed31c02b75f45bb328fd1d8e207a1160a02f1b77f17b30098c4d1cb0299.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
428f4ed31c02b75f45bb328fd1d8e207a1160a02f1b77f17b30098c4d1cb0299.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
4c27f9a78ca18364a6a42b5c61f94442782afef7fcc6a1cdfa9efc09b514cd04.ps1
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
4c27f9a78ca18364a6a42b5c61f94442782afef7fcc6a1cdfa9efc09b514cd04.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
4d9f557790e63bccbca6fbc20a47661e15869004db64412196b8756025ea1f24.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
4d9f557790e63bccbca6fbc20a47661e15869004db64412196b8756025ea1f24.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
4f7848518acd8847a6fc4f87ca7a20ef502641426ae1bb1353df989a8edc076d.doc
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
4f7848518acd8847a6fc4f87ca7a20ef502641426ae1bb1353df989a8edc076d.doc
Resource
win10v2004-20241007-en
General
-
Target
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx
-
Size
212KB
-
MD5
64a916779aff880848c06ce852b31cd7
-
SHA1
5134390defe2051426f0e77be6b638ce9b1c2bcd
-
SHA256
2f5246aacc1d8cbf159d08620a6cc50c5ff6764ea595d48447de38d99452f72b
-
SHA512
0c45325323f7d928a000845b1cc1fa06d95bce16f0371fa76c322997226103563c3bffa458e9385b82d73acba591f4e4e8b78108344f1fa49e841735c2f6ac68
-
SSDEEP
3072:AOY9VcEuVMPHZCvRiu5jLZbvXdm9MCbsoDb8AfXgq2qjwWFqwvE0zZ6lgKzzmI6:AF6iwvRJjNcsoDb1Yq2qjwivE0Nif
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5112 WINWORD.EXE 5112 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5112 WINWORD.EXE 5112 WINWORD.EXE 5112 WINWORD.EXE 5112 WINWORD.EXE 5112 WINWORD.EXE 5112 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810