Analysis
- max time kernel
133s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
18/02/2025, 14:32
General
- Target INQ_001825ABCPrj.docx
- Size 420KB
- Sample250218-rwdy2asrx4
- SHA256 95e45d55e2fc6dd48acddaeed3da271d42f1422fa49f13feeb42016a1a69816e
Malware Config
Signatures
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\INQ_001825ABCPrj.docx" /o ""1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
fb3b0dbfee58fac8.customDestinations-ms
memory/3020-22-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-37-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-2-0x00007FF918430000-0x00007FF918440000-memory.dmp
memory/3020-5-0x00007FF918430000-0x00007FF918440000-memory.dmp
memory/3020-21-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-9-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-8-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-11-0x00007FF916100000-0x00007FF916110000-memory.dmp
memory/3020-14-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-16-0x00007FF916100000-0x00007FF916110000-memory.dmp
memory/3020-20-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-18-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-3-0x00007FF918430000-0x00007FF918440000-memory.dmp
memory/3020-23-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-10-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-17-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-19-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-15-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-13-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-12-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-7-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-6-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-4-0x00007FF918430000-0x00007FF918440000-memory.dmp
memory/3020-0-0x00007FF95844D000-0x00007FF95844E000-memory.dmp
memory/3020-38-0x00007FF95844D000-0x00007FF95844E000-memory.dmp
memory/3020-39-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-40-0x00007FF9583B0000-0x00007FF9585A5000-memory.dmp
memory/3020-1-0x00007FF918430000-0x00007FF918440000-memory.dmp