Analysis

  • max time kernel
    3s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 22:08

General

  • Target

    2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3.docx

  • Size

    458KB

  • MD5

    918f63aeccaa7aeef06d25c031acd858

  • SHA1

    7234c8c1a704ee3cb3f9f30f560a02fd0f5ec87c

  • SHA256

    2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3

  • SHA512

    aa1bbd9609e92b1e5319c28586ef2a3ce105335f457069ea6c3c05ccde8b1d6b008cdac6f6236fde74a64f3e07695a5eb2ce5041101fbdf95c55c1f885fa7f87

  • SSDEEP

    6144:zzbUb0cVLNEzYvRSPlaMXKaAi69qltTGSmNZ5m9tmYL6qoPQ7tmYB/l2mDlJjAIJ:NkF5SPMM6I9X4Xs9mrm9Bt2mhW8G0Y8

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2c1e44e7ddf88303822b2a9e7cbfaeedbdbe3ace36ce3e028d19b68cf33c11b3.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\mnobizxv[1].doc

    Filesize

    670KB

    MD5

    c00a17e56e7eeaf2d72456692c36eec7

    SHA1

    72fbbce62454aaa611317d1c23a1980712d44613

    SHA256

    ee1c72ebaf43badfd7469960a19c0b2c54dc7485eff720cab2eb6bb9cf623c04

    SHA512

    ba0273b1afeb40e3c877fadc20e3ab3960e4db79272b042e500bc896d3986f607de401a2c300f97c42442e2ce4a03c241913a62439e96ff73b9795ad6527db97

  • C:\Users\Admin\AppData\Local\Temp\TCD38C2.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    410B

    MD5

    d403210f97b96dbb11154f497d2b33d2

    SHA1

    26311bac4d14e9dd13b199497dceb294cde9746b

    SHA256

    911557e80f3c04b0a9888033bbb790c327f9465eb6b0cffd43cb49614e6c0190

    SHA512

    63168adfeeb3b22347e355c8f44cfc382f45c36c0a2c7c80d3daddeb6821bf8fc7be45733eaaafca8c55408f13f90677ec02d8cd0151400357a4a8ae4fe330c8

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    be8ad73208910bd9f6c8737ad12ece32

    SHA1

    1567f777e635ba5594ba0f54824a9261076986e2

    SHA256

    d45c5fc464139df6f3fceb5fb2cb1a2976ea6e3d32efc316872db47b95ed4c70

    SHA512

    deed6a3a51fe2280318eea5f060596eac746c51466eeb378df088fb3665a0159a7a14a1bd3b7adfe6b7dead06c5c534f261d3165997bf64498f5ec19fa246064

  • memory/4136-17-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-9-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-12-0x00007FFEC5710000-0x00007FFEC5720000-memory.dmp

    Filesize

    64KB

  • memory/4136-10-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-13-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-8-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-16-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-18-0x00007FFEC5710000-0x00007FFEC5720000-memory.dmp

    Filesize

    64KB

  • memory/4136-21-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-20-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-19-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-15-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-14-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-1-0x00007FFEC7F90000-0x00007FFEC7FA0000-memory.dmp

    Filesize

    64KB

  • memory/4136-5-0x00007FFEC7F90000-0x00007FFEC7FA0000-memory.dmp

    Filesize

    64KB

  • memory/4136-6-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-0-0x00007FFF07FAD000-0x00007FFF07FAE000-memory.dmp

    Filesize

    4KB

  • memory/4136-11-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-7-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-66-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-67-0x00007FFF07FAD000-0x00007FFF07FAE000-memory.dmp

    Filesize

    4KB

  • memory/4136-69-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-68-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-75-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-74-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-73-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-72-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-71-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-70-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-76-0x00007FFF07F10000-0x00007FFF08105000-memory.dmp

    Filesize

    2.0MB

  • memory/4136-2-0x00007FFEC7F90000-0x00007FFEC7FA0000-memory.dmp

    Filesize

    64KB

  • memory/4136-4-0x00007FFEC7F90000-0x00007FFEC7FA0000-memory.dmp

    Filesize

    64KB

  • memory/4136-3-0x00007FFEC7F90000-0x00007FFEC7FA0000-memory.dmp

    Filesize

    64KB