Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 03:15
General
-
Target
b39cc1ce2d546ee6683e73264aaf094f4dd0ddae3b77bba5e3c0384523e66110.docx
-
Size
84KB
-
MD5
e8eeca2b17300555ce982ae3368ea55e
-
SHA1
18b108ab1f73ef5e7ff61a2d3e0235976e412081
-
SHA256
b39cc1ce2d546ee6683e73264aaf094f4dd0ddae3b77bba5e3c0384523e66110
-
SHA512
cf9b2462b907438c33d96aaf82238d45e4bbe2d771bf97122fc774112f46bd0e568e4058df65b7dd6d4096043470265175b2df2c8b914de20b3c79d005433fa4
-
SSDEEP
1536:aYtb7ih7kPw17kG1hc2FjOppzOYN1TThLdvV5brdSp2:aYt3ixkw17kc/OppzOYH39JV5brdSp2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b39cc1ce2d546ee6683e73264aaf094f4dd0ddae3b77bba5e3c0384523e66110.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD597f3291db00b29c1537f6faabfcf8983
SHA138ac80147123d212b5923160c7f29b93c25e885c
SHA2566f6e805c9473d6b4c0aec3b082cbc7e782b6c56a4d0048ef5902bb3ed8a8965c
SHA512ec3ccb5b3ab053968fa47048f6915de82e85bf1a4313eb479d34a9dbf4cd20ea059553c5f7407f8710da642f01356bc86411a10809575b286f43969d49a6cad0
-
Filesize
3KB
MD531d56d865881b09d6c92f5f8f69d6634
SHA1ad629a539b2e6b86bfd90b745e8176c9f58b702b
SHA25673fcdb91d1fbcf1b5e5353af5c3105bfdaaca5a2e4b2dc698135e4820c097921
SHA512e26d948f5fce36c67096594b7a639ae95dec5b8d69e2ffedb59113145b55b7de39186e10787953e303e34fcdcfdfa9c8372b15886f7f815a8418da7220820ef2
-
Filesize
211B
MD58c38089f1fe1713c07bd0b0e996cf259
SHA14bcab4ac5090a3cbda3ed0431bfbcf9acfd7e1dd
SHA256b361752ae86fab23809f98612a00799dbdc675e8bc3058b2a14980d5438254d4
SHA512ccc6af414acb81d6385c1bc0073daddc998d2d892e33dc5c42dbce265c5da81cfd90285ae582d719d5a22fd3596b1a55dd6192f2d8e4e55ed294ed7926671504
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB