Analysis
-
max time kernel
46s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 21:27
Static task
static1
Behavioral task
behavioral1
Sample
a08cd6a7c9e1555aeb12802a202727a43d5ce1a582b700f61be2637251a83ef7.docm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a08cd6a7c9e1555aeb12802a202727a43d5ce1a582b700f61be2637251a83ef7.docm
Resource
win10v2004-20240508-en
General
-
Target
a08cd6a7c9e1555aeb12802a202727a43d5ce1a582b700f61be2637251a83ef7.docm
-
Size
83KB
-
MD5
26dd4984304aa5dcb88637897f25fc11
-
SHA1
56fbdee77d4e75a68782c5ba82a908e7447f4c4b
-
SHA256
a08cd6a7c9e1555aeb12802a202727a43d5ce1a582b700f61be2637251a83ef7
-
SHA512
8e11a7db3a0e579ed9edcb9f43a228a05fd87efa37cb59511f5c246dc4809f16a75d40f733ff6760e1651a26501f90ddfecee76fb8ba6ac97bd17a398d83587e
-
SSDEEP
1536:gp+WqQuctgdKmZDj0gA/SpozBiIbusV/kaCZczqm/UqENyciWOXCls:K+X8YJXd2SpozBDu8/k2em8/8crOCC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
radB1281.tmp.exepid process 760 radB1281.tmp.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4572 WINWORD.EXE 4572 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4572 WINWORD.EXE 4572 WINWORD.EXE 4572 WINWORD.EXE 4572 WINWORD.EXE 4572 WINWORD.EXE 4572 WINWORD.EXE 4572 WINWORD.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4572 wrote to memory of 760 4572 WINWORD.EXE radB1281.tmp.exe PID 4572 wrote to memory of 760 4572 WINWORD.EXE radB1281.tmp.exe PID 4572 wrote to memory of 760 4572 WINWORD.EXE radB1281.tmp.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a08cd6a7c9e1555aeb12802a202727a43d5ce1a582b700f61be2637251a83ef7.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\radB1281.tmp.exe"C:\Users\Admin\AppData\Local\Temp\radB1281.tmp.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCD7EA4.tmp\sist02.xslFilesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
C:\Users\Admin\AppData\Local\Temp\radB1281.tmp.exeFilesize
72KB
MD515c88641d4a10ebe0764fea3a46d66c5
SHA126a9667d96023e917e2a133d0eba29ff37e0eb57
SHA256c439f95370c022b2af9815631dd34b66126510a59ae4972b098284d02dc4ff2f
SHA512f7afbf97b1a679b7c42af98f3d40cd5bbb0562748c56a2eca579aaa6dc2521e2b4a888d0012596d68a60dfa2233a35aff97fb7a745d360baf160e9a98fb22fc3
-
memory/760-67-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-14-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-555-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-5-0x00007FF8344CD000-0x00007FF8344CE000-memory.dmpFilesize
4KB
-
memory/4572-16-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-7-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-6-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-9-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-10-0x00007FF7F1D00000-0x00007FF7F1D10000-memory.dmpFilesize
64KB
-
memory/4572-11-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-12-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-17-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-18-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-15-0x00007FF7F1D00000-0x00007FF7F1D10000-memory.dmpFilesize
64KB
-
memory/4572-19-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-22-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-21-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-20-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-2-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/4572-8-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-4-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/4572-48-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-44-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-49-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-47-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-53-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-52-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-0-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/4572-65-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-1-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/4572-73-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-3-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/4572-389-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-453-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-544-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-545-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-13-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/4572-556-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB