Analysis

  • max time kernel
    101s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 17:34

General

  • Target

    $PLUGINSDIR/ask_eula.rtf

  • Size

    167KB

  • MD5

    7bd45e3280288dda6fd602031e2066e8

  • SHA1

    db4d49155de06f6a10ae50c01c612e4d998547bf

  • SHA256

    4346de72fee6dbe8b74218d8d9550395bf7f26634eb026ff6359fa0f855e9a4d

  • SHA512

    a3a40b878d46531127a55550c807e6a17374d5d52bd645ba6b61fc0ae551d348247c4d4969c32e60b7bdad7ce1b3167f3d87b4eab2746ae305f182d4084c09d3

  • SSDEEP

    1536:ZZAZp31HamwWkLTX6sbKIJ8rqj5mXoArAp0blt5S2y4e4N:ZIp3haYl2to

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ask_eula.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2156

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\TCDB2D4.tmp\iso690.xsl

          Filesize

          263KB

          MD5

          ff0e07eff1333cdf9fc2523d323dd654

          SHA1

          77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

          SHA256

          3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

          SHA512

          b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          29c5c6caf7da06dddae15e8c23328cb0

          SHA1

          d6ac7f7ddc065b75f2de1d4f5f4c493517b385c6

          SHA256

          843c4ca46240008e68ade5549ae2bcd27318106fafed9bb08c400c0e37a4f40c

          SHA512

          db3a8346437aa7f876063bbf784fd4a60ab496c1b1863ca216d64a3460f94831f1d3096818ffe75bde016570e3fe4858260b0da0d27d401b737534db59259107

        • memory/2156-10-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-14-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-4-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-5-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-0-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-11-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-12-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-8-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-13-0x00007FFF93600000-0x00007FFF93610000-memory.dmp

          Filesize

          64KB

        • memory/2156-7-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-3-0x00007FFFD5A6D000-0x00007FFFD5A6E000-memory.dmp

          Filesize

          4KB

        • memory/2156-15-0x00007FFF93600000-0x00007FFF93610000-memory.dmp

          Filesize

          64KB

        • memory/2156-9-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-6-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-27-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB

        • memory/2156-2-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-1-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-464-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-467-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-466-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-465-0x00007FFF95A50000-0x00007FFF95A60000-memory.dmp

          Filesize

          64KB

        • memory/2156-468-0x00007FFFD59D0000-0x00007FFFD5BC5000-memory.dmp

          Filesize

          2.0MB