Analysis
-
max time kernel
3s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 22:08
Static task
static1
Behavioral task
behavioral1
Sample
2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3.docx
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3.docx
Resource
win10v2004-20241007-en
General
-
Target
2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3.docx
-
Size
458KB
-
MD5
918f63aeccaa7aeef06d25c031acd858
-
SHA1
7234c8c1a704ee3cb3f9f30f560a02fd0f5ec87c
-
SHA256
2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3
-
SHA512
aa1bbd9609e92b1e5319c28586ef2a3ce105335f457069ea6c3c05ccde8b1d6b008cdac6f6236fde74a64f3e07695a5eb2ce5041101fbdf95c55c1f885fa7f87
-
SSDEEP
6144:zzbUb0cVLNEzYvRSPlaMXKaAi69qltTGSmNZ5m9tmYL6qoPQ7tmYB/l2mDlJjAIJ:NkF5SPMM6I9X4Xs9mrm9Bt2mhW8G0Y8
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4136 WINWORD.EXE 4136 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WINWORD.EXEdescription pid process Token: SeAuditPrivilege 4136 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXEpid process 4136 WINWORD.EXE 4136 WINWORD.EXE 4136 WINWORD.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
670KB
MD5c00a17e56e7eeaf2d72456692c36eec7
SHA172fbbce62454aaa611317d1c23a1980712d44613
SHA256ee1c72ebaf43badfd7469960a19c0b2c54dc7485eff720cab2eb6bb9cf623c04
SHA512ba0273b1afeb40e3c877fadc20e3ab3960e4db79272b042e500bc896d3986f607de401a2c300f97c42442e2ce4a03c241913a62439e96ff73b9795ad6527db97
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
410B
MD5d403210f97b96dbb11154f497d2b33d2
SHA126311bac4d14e9dd13b199497dceb294cde9746b
SHA256911557e80f3c04b0a9888033bbb790c327f9465eb6b0cffd43cb49614e6c0190
SHA51263168adfeeb3b22347e355c8f44cfc382f45c36c0a2c7c80d3daddeb6821bf8fc7be45733eaaafca8c55408f13f90677ec02d8cd0151400357a4a8ae4fe330c8
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5be8ad73208910bd9f6c8737ad12ece32
SHA11567f777e635ba5594ba0f54824a9261076986e2
SHA256d45c5fc464139df6f3fceb5fb2cb1a2976ea6e3d32efc316872db47b95ed4c70
SHA512deed6a3a51fe2280318eea5f060596eac746c51466eeb378df088fb3665a0159a7a14a1bd3b7adfe6b7dead06c5c534f261d3165997bf64498f5ec19fa246064