da485f602448b5e9d1aeb7fffb94fb5515bb319476ecb6c9e159cef8d96bb46a

Analysis

max time kernel
466s
max time network
448s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ClientSDK/90/Shared/Resources/1028/License_SysClrTypes.rtf
Size

124KB
MD5

af75df6971c1d09d31549698c1917eb2
SHA1

737b7c496498eb83cd13433861425b3c58c14f4c
SHA256

0cb71395534f598d40d12d80d0b1818b2715434a93cc2e4e63bb070aa20c0377
SHA512

ebcd8004fed3277769e559d5cfd61cda4909f7c4a78c092959432f6435d094300ab3fd422e1453cdcc8f0b0446b52b65bf8520b0dbb185aaf4d996979ebb3837
SSDEEP

3072:1w4J95k2o5XG0iRyXDlaO2ikE0Nud7T3LZqrJjrJoK2Z8e1UG:hJ9K2o5XRiRyTlaO2ik9Nud7T3LZqrJ6

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid	Process
3744	WINWORD.EXE
3744	WINWORD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

WINWORD.EXE

pid	Process
3744	WINWORD.EXE
3744	WINWORD.EXE
3744	WINWORD.EXE
3744	WINWORD.EXE
3744	WINWORD.EXE
3744	WINWORD.EXE
3744	WINWORD.EXE
3744	WINWORD.EXE
3744	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ClientSDK\90\Shared\Resources\1028\License_SysClrTypes.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCDB4E.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
6cf5455918d19e1503eaa96f5efc338f

SHA1
b2081d8e6a25bb293283abe70d4c598dca073a88

SHA256
8d76c2402f29a4efa3592d3639a23759b3811499ad7bbd5c924196a5b2c3e424

SHA512
97d8b4888aec6447215afd149b15b7ca3b73c177c677d886552eaf96be8bfae366185ab26f86476c350cd54f30a075848f75e31cef9fec3a3a9e9eec29a170b1

Download Submit
memory/3744-9-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-7-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-18-0x00007FFB91330000-0x00007FFB91340000-memory.dmp

Filesize
64KB

Download
memory/3744-2-0x00007FFB93550000-0x00007FFB93560000-memory.dmp

Filesize
64KB

Download
memory/3744-17-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-6-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-8-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-19-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-12-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-11-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-0-0x00007FFB93550000-0x00007FFB93560000-memory.dmp

Filesize
64KB

Download
memory/3744-16-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-4-0x00007FFB93550000-0x00007FFB93560000-memory.dmp

Filesize
64KB

Download
memory/3744-1-0x00007FFB93550000-0x00007FFB93560000-memory.dmp

Filesize
64KB

Download
memory/3744-10-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-20-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-21-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-22-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-14-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-13-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-15-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-23-0x00007FFB91330000-0x00007FFB91340000-memory.dmp

Filesize
64KB

Download
memory/3744-35-0x00007FFBD34D0000-0x00007FFBD36C5000-memory.dmp

Filesize
2.0MB

Download
memory/3744-5-0x00007FFB93550000-0x00007FFB93560000-memory.dmp

Filesize
64KB

Download
memory/3744-3-0x00007FFBD356D000-0x00007FFBD356E000-memory.dmp

Filesize
4KB

Download