Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/11/2024, 10:04
General
-
Target
SWIFT COPY 2.docx
-
Size
459KB
-
MD5
fd1963efc96cae15689f5e7eb9664b4b
-
SHA1
b4b13fc72a4bab883ae9ec4efc84cfe48c6b8d8a
-
SHA256
e763827e8385a621c0c28456d7c3fd0393b01d542b52a2b18bd5061492b97662
-
SHA512
50f91dba0d6180e02b8b1d5345ae024c9ed24666fb6c54e22798da122276dd1e1e85a43126826d9456e4db5e21fb762e9797d50f323cf498807d860935c04992
-
SSDEEP
6144:kMlcbR5HastSFXbqUAbqUAbqUvyLE8IIIIIW0ru0rqme6eeCe9vCeXhdrJ9tmYLk:/ARtUVhpr/rqIXt9mrm9Bt2mhW8G0YX
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SWIFT COPY 2.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
920KB
MD57dcb918d1d06064ea8ac517cf90113cb
SHA1d669c4f7b46d0ec5ef9d66bb8aa5a650913c9e4b
SHA2564a1ca6523f044927f03a353dca5742012370035ee216214bb8f0342ed113763c
SHA512cb3b4ab3281f9018d52f635843abb72b962ae158adf7cbb020986cf05aae9a506234090c6cd0d39adefbc3cd2becbe3ec19b11ae59e934cdafbf260b68a5aec1
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
391B
MD51215afd54695e52a20a045b775cbae78
SHA1c81b17fedb32b8a813a215b7844f5b043d8b0474
SHA256f4ac9c1edc04b97113a0cdd7bf5e9a87c77ef879658730c7f71d3bc7d5d009c7
SHA51217a0992a09dff2153a144e72fb9b5b778283bbbfb44eb722d5ab81c99ca12dfdf6c8d11185f788bc19f4f666fb33df4f51a009d580b66bfc9e07d570816f9784
-
Filesize
3KB
MD595034419bf82f53c7f5e303f514b215c
SHA18e153c0907944b4af9903b75b59b7a1272763919
SHA2562a8a73abc44c7abc3a4496d2acd270a1a4124a59aeb751ec884cd4f732216839
SHA51208c2b5f6afb836134c0e400c81296d0d7947ee9ef3033453861950abd27273ce530f9457a070212a056a9df81e1efa519b57c99b59d8f8330fe7c87182a4e6ed
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB