Overview
overview
10Static
static
102020-01-01...6.dotm
windows7-x64
102020-01-01...6.dotm
windows10-2004-x64
102020-01-02_74751.doc
windows7-x64
42020-01-02_74751.doc
windows10-2004-x64
12020-01-03_105342.doc
windows7-x64
102020-01-03_105342.doc
windows10-2004-x64
12020-01-03_134610.doc
windows7-x64
102020-01-03_134610.doc
windows10-2004-x64
12020-01-06_123924.doc
windows7-x64
42020-01-06_123924.doc
windows10-2004-x64
12020-01-06...9.dotm
windows7-x64
102020-01-06...9.dotm
windows10-2004-x64
102020-01-09...5.docm
windows7-x64
102020-01-09...5.docm
windows10-2004-x64
102020-01-11_81623.dotm
windows7-x64
102020-01-11_81623.dotm
windows10-2004-x64
102020-01-13_104457.rtf
windows7-x64
102020-01-13_104457.rtf
windows10-2004-x64
102020-01-13_144901.doc
windows7-x64
102020-01-13_144901.doc
windows10-2004-x64
62020-01-13_145745.doc
windows7-x64
102020-01-13_145745.doc
windows10-2004-x64
102020-01-13_152510.doc
windows7-x64
102020-01-13_152510.doc
windows10-2004-x64
102020-01-13_152527.doc
windows7-x64
102020-01-13_152527.doc
windows10-2004-x64
102020-01-13_153140.doc
windows7-x64
102020-01-13_153140.doc
windows10-2004-x64
102020-01-13_154531.doc
windows7-x64
102020-01-13_154531.doc
windows10-2004-x64
102020-01-13_154640.doc
windows7-x64
102020-01-13_154640.doc
windows10-2004-x64
10Analysis
-
max time kernel
145s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2024 12:42
Behavioral task
behavioral1
Sample
2020-01-01_162556.dotm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2020-01-01_162556.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
2020-01-02_74751.doc
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
2020-01-02_74751.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
2020-01-03_105342.doc
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
2020-01-03_105342.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
2020-01-03_134610.doc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
2020-01-03_134610.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
2020-01-06_123924.doc
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
2020-01-06_123924.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
2020-01-06_193259.dotm
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
2020-01-06_193259.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
2020-01-09_174205.docm
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
2020-01-09_174205.docm
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
2020-01-11_81623.dotm
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
2020-01-11_81623.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
2020-01-13_104457.rtf
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
2020-01-13_104457.rtf
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
2020-01-13_144901.doc
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
2020-01-13_144901.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
2020-01-13_145745.doc
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
2020-01-13_145745.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
2020-01-13_152510.doc
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
2020-01-13_152510.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
2020-01-13_152527.doc
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
2020-01-13_152527.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
2020-01-13_153140.doc
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
2020-01-13_153140.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
2020-01-13_154531.doc
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
2020-01-13_154531.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
2020-01-13_154640.doc
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
2020-01-13_154640.doc
Resource
win10v2004-20241007-en
General
-
Target
2020-01-03_105342.doc
-
Size
166KB
-
MD5
22f0101259aca82cc2b8dd103c58a3bd
-
SHA1
a23644411338f408a8a34a02f6350ae9fae51eee
-
SHA256
05d5e69f86c94bf709bec9cca1ddc533ad9a91573797ac3ab8173d15c6aa93bb
-
SHA512
fe467a7f3bf0280dfaf6271b0d80c27ae6053def3cda54c26bea8f714f6d573380a2e947318dc2076361b57dfd8f1402316b2c8e7c72b2b0e9c8ef5af7f314bc
-
SSDEEP
1536:3OwUaJIwFKZwiRysuqoKTjpimH9JMuyqWADsuMeC9nKP/5PJ0Zqm76Fwfq:eTaIlZwi9n7Qt/ADDMeCxUBPsqmGSf
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4056 WINWORD.EXE 4056 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4056 WINWORD.EXE 4056 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE 4056 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4056 wrote to memory of 4448 4056 WINWORD.EXE 86 PID 4056 wrote to memory of 4448 4056 WINWORD.EXE 86
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-03_105342.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642B
MD54f03b86e4d6631c26ff5fffc7332be1d
SHA114952a78ea51df67d5b5b6c6b4de3d96ba7935bd
SHA25683f4ea26254d69825486bffd1d400217aac7245c5c48fe5acc3ccdea173c4851
SHA5124bed29b66444d826e89589b55dd786758ff68fcd2daf8296703d4443edb991fffce563e20db22bfb34fdb488638bbb43252392b6c105d12e721329adc2774632
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5cba2bb747e54e3ad8a5845a8a754ea1a
SHA1cf12d4ea3de25cf123b34cffcd70be6136dc9a8f
SHA256f1787224cfba644ae3969c58a7cf9ce474f31bf1ef69a2b51b21b7418f2b92c1
SHA5121bde1300ee1b4cac16d9244b2bc645e154e8dd24e58ec05f5b6ae12057cf92fde46dd07e3bedabab37807547493bc34f501db952be618a86f3059ad1cbefc873