Overview
overview
10Static
static
1000ab8a1a2b...51.doc
windows7-x64
300ab8a1a2b...51.doc
windows10-2004-x64
104bbbaf0d0...25.exe
windows7-x64
304bbbaf0d0...25.exe
windows10-2004-x64
31139a9099f...64.exe
windows7-x64
31139a9099f...64.exe
windows10-2004-x64
3114a8c03ee...39.doc
windows7-x64
4114a8c03ee...39.doc
windows10-2004-x64
119911c6865...fc.exe
windows7-x64
19911c6865...fc.exe
windows10-2004-x64
2299ff9c7e...6.docx
windows7-x64
42299ff9c7e...6.docx
windows10-2004-x64
12b79b44b0f...07.dll
windows7-x64
52b79b44b0f...07.dll
windows10-2004-x64
52c6638998f...2a.xls
windows7-x64
32c6638998f...2a.xls
windows10-2004-x64
135352a7ac7...ce.exe
windows7-x64
35352a7ac7...ce.exe
windows10-2004-x64
3792408618...3f.xls
windows7-x64
33792408618...3f.xls
windows10-2004-x64
13b0fd96950...ea.dll
windows7-x64
53b0fd96950...ea.dll
windows10-2004-x64
54078c6d0ff...f7.lnk
windows7-x64
34078c6d0ff...f7.lnk
windows10-2004-x64
7428f4ed31c...99.dll
windows7-x64
1428f4ed31c...99.dll
windows10-2004-x64
14c27f9a78c...04.ps1
windows7-x64
34c27f9a78c...04.ps1
windows10-2004-x64
34d9f557790...24.exe
windows7-x64
74d9f557790...24.exe
windows10-2004-x64
74f7848518a...6d.doc
windows7-x64
34f7848518a...6d.doc
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2024 18:16
Behavioral task
behavioral1
Sample
00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
04bbbaf0d059bb09a2e44a3dbadb391a2f5aab5bfef5718fa3e8198502d0eb25.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
04bbbaf0d059bb09a2e44a3dbadb391a2f5aab5bfef5718fa3e8198502d0eb25.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
1139a9099f0424b533a49c8bc4ac5d569e67db11ff5fd02c8552a3461db7ba64.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
1139a9099f0424b533a49c8bc4ac5d569e67db11ff5fd02c8552a3461db7ba64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
19911c686578bafabd45a1e491333f1e0bc5eac5f6b1db29aa913dfd3dd207fc.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
19911c686578bafabd45a1e491333f1e0bc5eac5f6b1db29aa913dfd3dd207fc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
35352a7ac72a7962744268c134b1aacaba3eccd700e5c1378b4c13cf08d353ce.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
35352a7ac72a7962744268c134b1aacaba3eccd700e5c1378b4c13cf08d353ce.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
3792408618099db73b654704b12c9520d3267c37e50bf9718c2877ec2e65133f.xls
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
3792408618099db73b654704b12c9520d3267c37e50bf9718c2877ec2e65133f.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
3b0fd96950336e30d3586c719ad802d89668276fbc7d7209c8d8bf4e59eb6bea.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
3b0fd96950336e30d3586c719ad802d89668276fbc7d7209c8d8bf4e59eb6bea.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
428f4ed31c02b75f45bb328fd1d8e207a1160a02f1b77f17b30098c4d1cb0299.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
428f4ed31c02b75f45bb328fd1d8e207a1160a02f1b77f17b30098c4d1cb0299.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
4c27f9a78ca18364a6a42b5c61f94442782afef7fcc6a1cdfa9efc09b514cd04.ps1
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
4c27f9a78ca18364a6a42b5c61f94442782afef7fcc6a1cdfa9efc09b514cd04.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
4d9f557790e63bccbca6fbc20a47661e15869004db64412196b8756025ea1f24.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
4d9f557790e63bccbca6fbc20a47661e15869004db64412196b8756025ea1f24.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
4f7848518acd8847a6fc4f87ca7a20ef502641426ae1bb1353df989a8edc076d.doc
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
4f7848518acd8847a6fc4f87ca7a20ef502641426ae1bb1353df989a8edc076d.doc
Resource
win10v2004-20241007-en
General
-
Target
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc
-
Size
112KB
-
MD5
ce7cd4efedf806cdf7ce8e105ac4d709
-
SHA1
5e51ab412b24ba9340345f355062f10c4082b6d9
-
SHA256
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139
-
SHA512
dea7aaee858ef2d9a9125d2e690e99d687324a7c30eb8ce611ee6af95bb990a4108ee5231b9c6fe4a81d2b52832f52cda47778528534663322741aaa9cadf469
-
SSDEEP
1536:0ELDLXMzefraRIoixfcvxGUZgPassBaWCxXJDD3f:0ELDLXMzeeDwfcvTZVsC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2184 WINWORD.EXE 2184 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE 2184 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD589eb275774aa9a82ca3bb93028f13364
SHA12ea764cd97e0cb38bbf8d11c87c5703d5ddf8297
SHA2562811f4fde15116eff54a107bc0a918b81a4e1a177eb3351775954ffd5a18adb9
SHA5122dc359660bce57ff3eff4cdf2f1fdb144bc8a337c874df7b7943d55adf49b781a7f2ac5a1bae6e0e55b24b18970f8be8751a0119737404636e96dffc2c2d4c1c