Analysis

  • max time kernel
    133s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 17:25

General

  • Target

    Redline_20_2_crack/Panel/RedLine_20_2/FAQ(RUS).docx

  • Size

    51KB

  • MD5

    aa9534a22d08fb17b6c50164ca226aba

  • SHA1

    9d68e6e4b0ea3c41ad7f70733dc53628962765ce

  • SHA256

    e3f9590d0a28e8f17d40f9a5a5489a963c6d5e722a324adf0d1d666ea424c89f

  • SHA512

    a4290cf0f3ecbb25078a0d3f870ed6abcab83d831e107f59730cf5fbdbc0268ac831d8f31f18a08794e27e51ba302ecb5bdd4bac85f3887844ed881c363bb8b9

  • SSDEEP

    1536:YmF2FkS3yM0Yj3ePetyogAcLrANZLI3dakgXeV:YNFkGem74Lr+k3v7V

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Panel\RedLine_20_2\FAQ(RUS).docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDF192.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    69c6907d21e0ce093050031c481e6343

    SHA1

    d00277bd2ad56f8e284a1db9214abcb4011c9c11

    SHA256

    ff33158d39c56e11cdd17c9296d81981a6be96003c94ebde7911598fbc17d799

    SHA512

    2a4d267d6b60031bd97d8d66c0c2bebd138b7da831d5b5d6bcaa80b59e0f8e872365f22093969bb4c030e94f8da28deab2ee7e3892dd1944d5efe45485b39649

  • memory/3732-10-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-21-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-8-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-22-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-6-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-19-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-18-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-17-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-15-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-13-0x00007FFA76890000-0x00007FFA768A0000-memory.dmp

    Filesize

    64KB

  • memory/3732-12-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-5-0x00007FFA78C10000-0x00007FFA78C20000-memory.dmp

    Filesize

    64KB

  • memory/3732-7-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-9-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-23-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-20-0x00007FFA76890000-0x00007FFA768A0000-memory.dmp

    Filesize

    64KB

  • memory/3732-11-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-4-0x00007FFA78C10000-0x00007FFA78C20000-memory.dmp

    Filesize

    64KB

  • memory/3732-3-0x00007FFA78C10000-0x00007FFA78C20000-memory.dmp

    Filesize

    64KB

  • memory/3732-2-0x00007FFA78C10000-0x00007FFA78C20000-memory.dmp

    Filesize

    64KB

  • memory/3732-0-0x00007FFAB8C2D000-0x00007FFAB8C2E000-memory.dmp

    Filesize

    4KB

  • memory/3732-1-0x00007FFA78C10000-0x00007FFA78C20000-memory.dmp

    Filesize

    64KB

  • memory/3732-39-0x00007FFAB8C2D000-0x00007FFAB8C2E000-memory.dmp

    Filesize

    4KB

  • memory/3732-40-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-41-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-16-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-47-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-48-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB

  • memory/3732-14-0x00007FFAB8B90000-0x00007FFAB8D85000-memory.dmp

    Filesize

    2.0MB