Resubmissions

30-12-2024 19:51

241230-yk1f8awkfk 10

20-09-2024 23:58

240920-31bv1svgna 10

Analysis

  • max time kernel
    136s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2024 19:51

General

  • Target

    5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc

  • Size

    507KB

  • MD5

    5f9f8ac1f749b0637eca6ef15910bf21

  • SHA1

    dae74fc73f98b3b9b6fd094ae512b71e499e3eb5

  • SHA256

    593e4acae0c1e2a708cf986adfd0f4e59ec356c1031a97a65a87404943da94ff

  • SHA512

    6b54f42a83797f332146a9c46a2ec48bc1f00bdfde6f2ff4254ec337a7f6e46d4105ee6f9bf487929323df97f3d633ce2ccbb15866d46482fc1aeaebe14b9d08

  • SSDEEP

    96:TAy6k2M3jwlgNqvoMhx4FAcx4AmGLGQSrWWWuHMIkJMbRVPkMJbxjz8MwKz:srM3jwK8vIfxDqQSfhkJmPkMxw

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

    Filesize

    3B

    MD5

    8a80554c91d9fca8acb82f023de02f11

    SHA1

    5f36b2ea290645ee34d943220a14b54ee5ea5be5

    SHA256

    ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

    SHA512

    ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

    Filesize

    16B

    MD5

    d29962abc88624befc0135579ae485ec

    SHA1

    e40a6458296ec6a2427bcb280572d023a9862b31

    SHA256

    a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

    SHA512

    4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

  • memory/4544-7-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-9-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-18-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-5-0x00007FF9F8E30000-0x00007FF9F8E40000-memory.dmp

    Filesize

    64KB

  • memory/4544-15-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-10-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-11-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-17-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-13-0x00007FF9F66D0000-0x00007FF9F66E0000-memory.dmp

    Filesize

    64KB

  • memory/4544-12-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-0-0x00007FF9F8E30000-0x00007FF9F8E40000-memory.dmp

    Filesize

    64KB

  • memory/4544-6-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-4-0x00007FF9F8E30000-0x00007FF9F8E40000-memory.dmp

    Filesize

    64KB

  • memory/4544-1-0x00007FFA38E4D000-0x00007FFA38E4E000-memory.dmp

    Filesize

    4KB

  • memory/4544-8-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-19-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-20-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-16-0x00007FF9F66D0000-0x00007FF9F66E0000-memory.dmp

    Filesize

    64KB

  • memory/4544-14-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-2-0x00007FF9F8E30000-0x00007FF9F8E40000-memory.dmp

    Filesize

    64KB

  • memory/4544-30-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-31-0x00007FFA38E4D000-0x00007FFA38E4E000-memory.dmp

    Filesize

    4KB

  • memory/4544-32-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-37-0x00007FFA38DB0000-0x00007FFA38FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4544-3-0x00007FF9F8E30000-0x00007FF9F8E40000-memory.dmp

    Filesize

    64KB