Analysis

  • max time kernel
    133s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2025 02:35

General

  • Target

    $PLUGINSDIR/DefaultTab_license2.rtf

  • Size

    71KB

  • MD5

    e99f5ae5ed184da5d9b48d71b9c961ab

  • SHA1

    05e157f6d5a425c7f794b00b0e2675499eaba4b3

  • SHA256

    cb1ea8a42e44d26b091ee608f5ca7fa2fa141eafe0e3100a3e78a0114c8f8506

  • SHA512

    a167af13208b3c12384a640d9ea800c739032ef5a6e3100eb805c58617ce170b9347768460f66529987448d86011ff774095df7953ba52ae55ea36aaa1684255

  • SSDEEP

    768:0Nzwautez/pKLpz+bTOFKgPFAayBmhUxRGayBmhpoJ5rCKGCHoYDYWtRIaQE92z7:05wvWnCDazxH7r1O9u

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DefaultTab_license2.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD68A.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    4efd7dc14b7f1767c29587ae9cbc6e20

    SHA1

    5d96a70e59d43fdd0e9e1c834b8040688cff460f

    SHA256

    bd606bcf308c3bce8fd7915498aa049d9334784bac481fa89b3a952a09ce7d55

    SHA512

    d9ae9dcf08dc92e3b34631399980d1237b843064766cf60691f07b09bea11f0ac57471e307fd8ed22e736701c99a3c326eea7909542967a6777428dbcddf58ac

  • memory/1296-4-0x00007FF851FF0000-0x00007FF852000000-memory.dmp

    Filesize

    64KB

  • memory/1296-6-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-14-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-7-0x00007FF851FF0000-0x00007FF852000000-memory.dmp

    Filesize

    64KB

  • memory/1296-5-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-9-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-11-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-10-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-13-0x00007FF84FBB0000-0x00007FF84FBC0000-memory.dmp

    Filesize

    64KB

  • memory/1296-8-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-0-0x00007FF851FF0000-0x00007FF852000000-memory.dmp

    Filesize

    64KB

  • memory/1296-2-0x00007FF851FF0000-0x00007FF852000000-memory.dmp

    Filesize

    64KB

  • memory/1296-12-0x00007FF84FBB0000-0x00007FF84FBC0000-memory.dmp

    Filesize

    64KB

  • memory/1296-17-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-16-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-15-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-29-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-30-0x00007FF89200D000-0x00007FF89200E000-memory.dmp

    Filesize

    4KB

  • memory/1296-31-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-32-0x00007FF891F70000-0x00007FF892165000-memory.dmp

    Filesize

    2.0MB

  • memory/1296-3-0x00007FF851FF0000-0x00007FF852000000-memory.dmp

    Filesize

    64KB

  • memory/1296-1-0x00007FF89200D000-0x00007FF89200E000-memory.dmp

    Filesize

    4KB