Overview
overview
10Static
static
1ETool.exe
windows10-2004-x64
10$TEMP/Exposure.doc
windows10-2004-x64
1$TEMP/Surrey.doc
windows10-2004-x64
1$TEMP/Tramadol.doc
windows10-2004-x64
1SpringPrer...ck.doc
windows10-2004-x64
1SpringPrer...ge.doc
windows10-2004-x64
1SpringPrer...ne.doc
windows10-2004-x64
1SpringPrer...em.doc
windows10-2004-x64
1SpringPrer...on.doc
windows10-2004-x64
1SpringPrer...nt.doc
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2025, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
ETool.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral2
Sample
$TEMP/Exposure.doc
Resource
win10v2004-20250313-en
Behavioral task
behavioral3
Sample
$TEMP/Surrey.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
$TEMP/Tramadol.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
SpringPrerequisite/Click.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral6
Sample
SpringPrerequisite/Dosage.doc
Resource
win10v2004-20250313-en
Behavioral task
behavioral7
Sample
SpringPrerequisite/Hurricane.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral8
Sample
SpringPrerequisite/Jerusalem.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
SpringPrerequisite/Replication.doc
Resource
win10v2004-20250314-en
Behavioral task
behavioral10
Sample
SpringPrerequisite/Vincent.doc
Resource
win10v2004-20250314-en
General
-
Target
SpringPrerequisite/Click.doc
-
Size
76KB
-
MD5
b6a810b4b1ce28f016bccff1d52f2147
-
SHA1
5590bc8521c201f44ccf9427ce34acfb35c66db2
-
SHA256
3f640b7668a38ec1b3f2dfd2a4a2032ce85c503fbcd7dd27bb414cede27a5e8e
-
SHA512
45822bfd060ffd528e96d76cb2b59a0c07b038451bf984cf13d617c59188854cf657b4e9a72d99b7d81fc147ef451588568454bc3b9cff5522eb49156d698464
-
SSDEEP
1536:Bj5oO3oVM550Yc7rjH5kt7YE4XjvwulWqqnh7JDnnDfs8d1M8x:Bj5oO3tX1UkezIkWTnFR1W8x
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4420 WINWORD.EXE 4420 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE 4420 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SpringPrerequisite\Click.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4420