Analysis
-
max time kernel
146s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 19:09
General
-
Target
Bank Swift Copy.docx
-
Size
459KB
-
MD5
3f9ae2b975cec92e0402d614cd2391a5
-
SHA1
43d41944021358bee6b6b48594d9c3f54fbaecd5
-
SHA256
27a37162f8f0baf5fe161825f8108f1f3e20bada83c2be08fe9919c60e4727b8
-
SHA512
1a14966056b58e84438309a1dea5ed4d5a6036b76cde5b0baec395d87bcfb2edf596bf9c201c0310847972f89c04c866f2008e938791b233ffb7042365222771
-
SSDEEP
6144:drlcbR5HastSFXbqUAbqUAbqUvyLE8IIIIIW0ru0rqme6eeCe9vCeXhdwt9tmYL+:RARtUVhpr/rqIXg9mrm9Bt2mhW8G0Y1Z
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Bank Swift Copy.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
799KB
MD52087de574fefae441db7ced132da6407
SHA16d8b4083d71075be31068808232805ea486f77d8
SHA256dc8ae41681fdf19abcf62b27b3d8359c32ba6f20bee1e24b7ce9b37d4faebe8b
SHA51202ead1047af13379ee161c25e1db2c83033daf752629159b9c5836ed0c1d5f6436da73299d920cc10cefe6d4edd3272266d9b4f2088225bc434a53c20ba43ce9
-
Filesize
72B
MD55617b91c16ea99a0f3041eff7cbecf35
SHA1bbf184de7592e808a38354e44de620cfb59d098c
SHA256bc125e2e9ce2977b0182287efe15d8d2a4845b78d99bd93363e9c2fd26e987f2
SHA512033fe7d64e797037eb02024de68d34125c7ebba95faa61ee6920be5acbc86837467897603fc7884089fb514503fec78987453a5b58196b5504d5e3089cb16758
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB