Analysis

  • max time kernel
    133s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2025, 21:03

General

  • Target

    MihalyLevente_Vezetotrening.docx

  • Size

    18KB

  • MD5

    b443528e516923416423f8ec45675334

  • SHA1

    0682c887258d00b4e9a32be446e3d51d2270c2b4

  • SHA256

    4e1fc557e9d03f5f26f51504e9eafd71da654ebeec958a32991ce3d4feda5500

  • SHA512

    41e9d74a2f1229547ab747fd3a670f4728f3a3f23105f91272c28d3edb860a13d744f73be4b0f93f2ac4f84f96a50d6847af935cd0495a3ce1676dbea44ca4d8

  • SSDEEP

    384:aNOe++wwZpYarc42VAxCSYYsDnw4NaXqKTbhw8FSXNvQbYgjW:TedBcPAxRUnmaQhP0dvFx

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\MihalyLevente_Vezetotrening.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDFFAE.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    db6ad4b146f049e392df10e23c2cbead

    SHA1

    8a8b2230b45c4929fd9950f241c6e6b99795a1a3

    SHA256

    72898ad6193e403b999dc62b57f39bda918170a98c21dd464467719a5d145c69

    SHA512

    2443d2fb16e65ac47cf83f030df7e7af3ce9927a8c7e5e5bce06170a066c561dfac4759fe25d5649695dbfb5ba06e22c8a2a5d3b2556aedcca077a5a3de707cf

  • memory/2372-20-0x00007FFCEC560000-0x00007FFCEC570000-memory.dmp

    Filesize

    64KB

  • memory/2372-13-0x00007FFCEC560000-0x00007FFCEC570000-memory.dmp

    Filesize

    64KB

  • memory/2372-5-0x00007FFCEEC50000-0x00007FFCEEC60000-memory.dmp

    Filesize

    64KB

  • memory/2372-4-0x00007FFCEEC50000-0x00007FFCEEC60000-memory.dmp

    Filesize

    64KB

  • memory/2372-6-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-7-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-11-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-9-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-8-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-12-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-14-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-15-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-19-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-18-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-22-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-21-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-0-0x00007FFD2EC6D000-0x00007FFD2EC6E000-memory.dmp

    Filesize

    4KB

  • memory/2372-17-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-2-0x00007FFCEEC50000-0x00007FFCEEC60000-memory.dmp

    Filesize

    64KB

  • memory/2372-16-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-10-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-37-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-36-0x00007FFD2EC6D000-0x00007FFD2EC6E000-memory.dmp

    Filesize

    4KB

  • memory/2372-38-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-39-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-40-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-46-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-45-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-44-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-47-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-48-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-43-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-42-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-41-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-49-0x00007FFD2EBD0000-0x00007FFD2EDC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2372-3-0x00007FFCEEC50000-0x00007FFCEEC60000-memory.dmp

    Filesize

    64KB

  • memory/2372-1-0x00007FFCEEC50000-0x00007FFCEEC60000-memory.dmp

    Filesize

    64KB