Analysis

  • max time kernel
    145s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2024 12:42

General

  • Target

    2020-01-03_105342.doc

  • Size

    166KB

  • MD5

    22f0101259aca82cc2b8dd103c58a3bd

  • SHA1

    a23644411338f408a8a34a02f6350ae9fae51eee

  • SHA256

    05d5e69f86c94bf709bec9cca1ddc533ad9a91573797ac3ab8173d15c6aa93bb

  • SHA512

    fe467a7f3bf0280dfaf6271b0d80c27ae6053def3cda54c26bea8f714f6d573380a2e947318dc2076361b57dfd8f1402316b2c8e7c72b2b0e9c8ef5af7f314bc

  • SSDEEP

    1536:3OwUaJIwFKZwiRysuqoKTjpimH9JMuyqWADsuMeC9nKP/5PJ0Zqm76Fwfq:eTaIlZwi9n7Qt/ADDMeCxUBPsqmGSf

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-03_105342.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BA87DAEA.wmf

      Filesize

      642B

      MD5

      4f03b86e4d6631c26ff5fffc7332be1d

      SHA1

      14952a78ea51df67d5b5b6c6b4de3d96ba7935bd

      SHA256

      83f4ea26254d69825486bffd1d400217aac7245c5c48fe5acc3ccdea173c4851

      SHA512

      4bed29b66444d826e89589b55dd786758ff68fcd2daf8296703d4443edb991fffce563e20db22bfb34fdb488638bbb43252392b6c105d12e721329adc2774632

    • C:\Users\Admin\AppData\Local\Temp\TCD61F3.tmp\sist02.xsl

      Filesize

      245KB

      MD5

      f883b260a8d67082ea895c14bf56dd56

      SHA1

      7954565c1f243d46ad3b1e2f1baf3281451fc14b

      SHA256

      ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

      SHA512

      d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

      Filesize

      1KB

      MD5

      cba2bb747e54e3ad8a5845a8a754ea1a

      SHA1

      cf12d4ea3de25cf123b34cffcd70be6136dc9a8f

      SHA256

      f1787224cfba644ae3969c58a7cf9ce474f31bf1ef69a2b51b21b7418f2b92c1

      SHA512

      1bde1300ee1b4cac16d9244b2bc645e154e8dd24e58ec05f5b6ae12057cf92fde46dd07e3bedabab37807547493bc34f501db952be618a86f3059ad1cbefc873

    • memory/4056-7-0x00007FF973AF0000-0x00007FF973B00000-memory.dmp

      Filesize

      64KB

    • memory/4056-17-0x00007FF971A90000-0x00007FF971AA0000-memory.dmp

      Filesize

      64KB

    • memory/4056-5-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-6-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-1-0x00007FF9B3B0D000-0x00007FF9B3B0E000-memory.dmp

      Filesize

      4KB

    • memory/4056-9-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-10-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-8-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-11-0x00007FF971A90000-0x00007FF971AA0000-memory.dmp

      Filesize

      64KB

    • memory/4056-12-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-13-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-14-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-16-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-4-0x00007FF973AF0000-0x00007FF973B00000-memory.dmp

      Filesize

      64KB

    • memory/4056-15-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-18-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-20-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-19-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-2-0x00007FF973AF0000-0x00007FF973B00000-memory.dmp

      Filesize

      64KB

    • memory/4056-64-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-65-0x00007FF9B3B0D000-0x00007FF9B3B0E000-memory.dmp

      Filesize

      4KB

    • memory/4056-66-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-70-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

      Filesize

      2.0MB

    • memory/4056-0-0x00007FF973AF0000-0x00007FF973B00000-memory.dmp

      Filesize

      64KB

    • memory/4056-3-0x00007FF973AF0000-0x00007FF973B00000-memory.dmp

      Filesize

      64KB