Overview
overview
10Static
static
35F9F8AC1F7...D_.doc
windows7-x64
45F9F8AC1F7...D_.doc
windows10-2004-x64
16B97B3CD2F...et.exe
windows7-x64
16B97B3CD2F...et.exe
windows10-2004-x64
3901FA02FFD...ar.dll
windows7-x64
3901FA02FFD...ar.dll
windows10-2004-x64
3C116CD0832..._2.exe
windows7-x64
10C116CD0832..._2.exe
windows10-2004-x64
10PlugX_3C74...20.dll
windows7-x64
10PlugX_3C74...20.dll
windows10-2004-x64
10originalfi...ae.rtf
windows7-x64
4originalfi...ae.rtf
windows10-2004-x64
1Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2024 19:51
Static task
static1
Behavioral task
behavioral1
Sample
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
6B97B3CD2FCFB4B74985143230441463_Gadget.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
6B97B3CD2FCFB4B74985143230441463_Gadget.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
C116CD083284CC599C024C3479CA9B70_2.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
C116CD083284CC599C024C3479CA9B70_2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae.rtf
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae.rtf
Resource
win10v2004-20241007-en
General
-
Target
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc
-
Size
507KB
-
MD5
5f9f8ac1f749b0637eca6ef15910bf21
-
SHA1
dae74fc73f98b3b9b6fd094ae512b71e499e3eb5
-
SHA256
593e4acae0c1e2a708cf986adfd0f4e59ec356c1031a97a65a87404943da94ff
-
SHA512
6b54f42a83797f332146a9c46a2ec48bc1f00bdfde6f2ff4254ec337a7f6e46d4105ee6f9bf487929323df97f3d633ce2ccbb15866d46482fc1aeaebe14b9d08
-
SSDEEP
96:TAy6k2M3jwlgNqvoMhx4FAcx4AmGLGQSrWWWuHMIkJMbRVPkMJbxjz8MwKz:srM3jwK8vIfxDqQSfhkJmPkMxw
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4544 WINWORD.EXE 4544 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE 4544 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3B
MD58a80554c91d9fca8acb82f023de02f11
SHA15f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f