Analysis
-
max time kernel
92s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2025, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
a32a27ceefc724f43ae4b66df898b2f659df2e5b1c7ce819d9667846093814e6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a32a27ceefc724f43ae4b66df898b2f659df2e5b1c7ce819d9667846093814e6.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
Masculinizes/Reactionally/specklessness.doc
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Masculinizes/Reactionally/specklessness.doc
Resource
win10v2004-20250217-en
General
-
Target
Masculinizes/Reactionally/specklessness.doc
-
Size
397KB
-
MD5
20108545afc650a1f43d483971760f55
-
SHA1
1986b56f0dbad72fc093bbb384ae7c9a01efeb95
-
SHA256
119e43c5cd9c43ff31e82f9bf6711dd4f488e5a450e1acfcac87c19cc0c6fff7
-
SHA512
dd89cfbb13b373d87c144f3788b9e5e037e308c9af45d78f10cd74707d5ce86d91a7a493431be7d4c896cc7f95ee0d48ae5307f46272ddba3d64c910b578bbe8
-
SSDEEP
1536:23sQmlZgy2I3m6/jsf63QEbm3VDClp5BFUOWCTcN/aQYdLq/iTv8cTynJB17eJsw:KTyLuCpMrBodKCra6ZM4hJ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4884 WINWORD.EXE 4884 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE 4884 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Masculinizes\Reactionally\specklessness.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4884