Overview
overview
10Static
static
35af0f5b0ba...de.exe
windows7-x64
105af0f5b0ba...de.exe
windows10-2004-x64
10MihalyLeve...g.docx
windows7-x64
3MihalyLeve...g.docx
windows10-2004-x64
1Mihály Le...17.pdf
windows7-x64
3Mihály Le...17.pdf
windows10-2004-x64
3Mérések ...2.xlsx
windows7-x64
3Mérések ...2.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
133s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2025, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
MihalyLevente_Vezetotrening.docx
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
MihalyLevente_Vezetotrening.docx
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
Mihály Levente_Tartalmi kivonat_2017.pdf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Mihály Levente_Tartalmi kivonat_2017.pdf
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
Mérések Co2 lézeres kezelésre_v2.xlsx
Resource
win7-20250207-en
Behavioral task
behavioral8
Sample
Mérések Co2 lézeres kezelésre_v2.xlsx
Resource
win10v2004-20250314-en
General
-
Target
MihalyLevente_Vezetotrening.docx
-
Size
18KB
-
MD5
b443528e516923416423f8ec45675334
-
SHA1
0682c887258d00b4e9a32be446e3d51d2270c2b4
-
SHA256
4e1fc557e9d03f5f26f51504e9eafd71da654ebeec958a32991ce3d4feda5500
-
SHA512
41e9d74a2f1229547ab747fd3a670f4728f3a3f23105f91272c28d3edb860a13d744f73be4b0f93f2ac4f84f96a50d6847af935cd0495a3ce1676dbea44ca4d8
-
SSDEEP
384:aNOe++wwZpYarc42VAxCSYYsDnw4NaXqKTbhw8FSXNvQbYgjW:TedBcPAxRUnmaQhP0dvFx
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2372 WINWORD.EXE 2372 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE 2372 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\MihalyLevente_Vezetotrening.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5db6ad4b146f049e392df10e23c2cbead
SHA18a8b2230b45c4929fd9950f241c6e6b99795a1a3
SHA25672898ad6193e403b999dc62b57f39bda918170a98c21dd464467719a5d145c69
SHA5122443d2fb16e65ac47cf83f030df7e7af3ce9927a8c7e5e5bce06170a066c561dfac4759fe25d5649695dbfb5ba06e22c8a2a5d3b2556aedcca077a5a3de707cf