Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 20:12
General
-
Target
049261b1ba10fc409cebee2220f6c16b66a24d45fdf51a8613c6be0870ff2309.docx
-
Size
10KB
-
MD5
ce5512a94aa59985b3b8f371a0866da0
-
SHA1
0dfb6f37eb2eb1badb8ab9c0754de0874f4fcfd4
-
SHA256
049261b1ba10fc409cebee2220f6c16b66a24d45fdf51a8613c6be0870ff2309
-
SHA512
eae07e86ae5dfdd15cdf74dcd2a17502cb8e59fe51aa1d6f64c8a7a14fee8a435f9082a25c9e0566a47765d992037851bc929c5eb53ca80c461327d0a3c973d3
-
SSDEEP
192:ScIMmtPi95kG/bGv7m7sOVIOdBf0krFnuTE3dz5b:SPXIBGv7jOVjvlrFnuInb
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\049261b1ba10fc409cebee2220f6c16b66a24d45fdf51a8613c6be0870ff2309.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD579fa77789877cdffac1eedf994dfe0ac
SHA15353fdfb8d16fc6f7dea28a4084e45193cab3597
SHA25639b27cdd54378d6efeafc075093cbd3d1786239247e37b808401ba973eac8673
SHA5129fb4f7c37501c4cd722fa31750d7bb780566627ca2c5733f951e90ea27803176896b582ea3d16e6c1e92917f5a934bcd9d77ba72cbe416812517c7f27df48276
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
297B
MD563f4a40e9ae441ac2bb895fca6e2337a
SHA1d68528d326f865946dc7653a27abf0f2143681b3
SHA25605ccd45fac214c2afe5eafd74cd8933e722c730831d0e4e536012b965e7dd399
SHA512a5c3273f654cda71cdfe3ae46a6d17372fc60d70148cf3f7fb73ca7ed303cad594bde4ed570b8355739f167eab29f5a371cf5b1287f420685deacc7337987660
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB