Overview
overview
10Static
static
7Licenses/1...12.rtf
windows10-1703-x64
6Licenses/1...12.rtf
windows10-1703-x64
1Licenses/1...es.rtf
windows10-1703-x64
1Licenses/1...ls.rtf
windows10-1703-x64
1Licenses/1...ct.rtf
windows10-1703-x64
1Licenses/1...rk.rtf
windows10-1703-x64
1Licenses/1...ls.rtf
windows10-1703-x64
1Licenses/1...ss.rtf
windows10-1703-x64
1Licenses/1...R2.rtf
windows10-1703-x64
1Licenses/1...DB.rtf
windows10-1703-x64
1Licenses/1...LI.rtf
windows10-1703-x64
1Licenses/1...ts.rtf
windows10-1703-x64
1Licenses/1...ce.rtf
windows10-1703-x64
1Licenses/1...ce.rtf
windows10-1703-x64
1Licenses/1...om.rtf
windows10-1703-x64
1Licenses/1...er.rtf
windows10-1703-x64
1Licenses/s...se.rtf
windows10-1703-x64
1Licenses/s...es.rtf
windows10-1703-x64
1Setup.exe
windows10-1703-x64
10Team Tools...es.dll
windows10-1703-x64
1Team Tools...ge.exe
windows10-1703-x64
1Team Tools...64.dll
windows10-1703-x64
1Team Tools...10.dll
windows10-1703-x64
7Team Tools...32.dll
windows10-1703-x64
1Team Tools...10.dll
windows10-1703-x64
1Team Tools...es.dll
windows10-1703-x64
1Team Tools...UI.dll
windows10-1703-x64
1Team Tools...ui.dll
windows10-1703-x64
1Team Tools...ui.dll
windows10-1703-x64
1Team Tools...ui.dll
windows10-1703-x64
1Team Tools...ol.dll
windows10-1703-x64
1Team Tools...er.dll
windows10-1703-x64
1Analysis
-
max time kernel
211s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30-06-2024 22:29
Behavioral task
behavioral1
Sample
Licenses/1049/EntityFrameworkDesignerForVisualStudio2012.rtf
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Licenses/1049/ReportViewerAddOnForVisualStudio2012.rtf
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Licenses/1049/SQL08CLRtypes.rtf
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Licenses/1049/SQLCmdLnUtils.rtf
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
Licenses/1049/SQLServerCompact.rtf
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Licenses/1049/SQLServerDACFramework.rtf
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Licenses/1049/SQLServerDataTools.rtf
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Licenses/1049/SQLServerExpress.rtf
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Licenses/1049/SQLServerExpress2008R2.rtf
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Licenses/1049/SQLServerLocalDB.rtf
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Licenses/1049/SQLServerNativeCLI.rtf
Resource
win10-20240611-en
Behavioral task
behavioral12
Sample
Licenses/1049/SQLServerSharedManagementObjects.rtf
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Licenses/1049/SQLServerTSQLCompilerservice.rtf
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Licenses/1049/SQLServerTSQLlanguageservice.rtf
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Licenses/1049/SQLServerTransact-SQLScriptDom.rtf
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Licenses/1049/SysClrTypes_SQLServer.rtf
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Licenses/sdk_license.rtf
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Licenses/sdk_third_party_notices.rtf
Resource
win10-20240611-en
Behavioral task
behavioral19
Sample
Setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
Team Tools/Dynamic Code Coverage Tools/CodeCoverageMessages.dll
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
Team Tools/Dynamic Code Coverage Tools/amd64/CodeCoverage.exe
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
Team Tools/Dynamic Code Coverage Tools/amd64/covrun64.dll
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
Team Tools/Dynamic Code Coverage Tools/amd64/msdia110.dll
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
Team Tools/Dynamic Code Coverage Tools/covrun32.dll
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
Team Tools/Dynamic Code Coverage Tools/msdia110.dll
Resource
win10-20240611-en
Behavioral task
behavioral26
Sample
Team Tools/Dynamic Code Coverage Tools/ru/CodeCoverageMessages.dll
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
Team Tools/Performance Tools/1049/TSDevPkgUI.dll
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
Team Tools/Performance Tools/1049/perfpkgui.dll
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
Team Tools/Performance Tools/1049/vsinstrui.dll
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
Team Tools/Performance Tools/1049/vspmsgui.dll
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
Team Tools/Performance Tools/KernelTraceControl.dll
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
Team Tools/Performance Tools/Microsoft.VisualStudio.Enterprise.AspNetHelper.dll
Resource
win10-20240611-en
General
-
Target
Licenses/1049/ReportViewerAddOnForVisualStudio2012.rtf
-
Size
16KB
-
MD5
aaf0f66072b4190b7dd8be5ba0eff7ae
-
SHA1
5e3eec90c3b4db2b33e6d798a7b92294bae7c15c
-
SHA256
f38ffa3737d6bc0bc62e26879f56913c75d0108531f1fc7fdd5026b018e2a8c6
-
SHA512
a9c6dd06f0312d7226b6ce6849cfef7f533e1e4e1826a016c0ff7e40d63628d424fa84b64ca15e1259adde945a16826ac64c1babd96c31a6decdbe9bd15d1659
-
SSDEEP
192:bfrtIuCAFXVacaFIaCXtMOd6DjNaORtxRpRNw+Y1YqKajyfMZgZja0gkpEGyesYH:XbCEoU8tvAVCEztAgW/IpSidBKeV2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4256 WINWORD.EXE 4256 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 4256 WINWORD.EXE 4256 WINWORD.EXE 4256 WINWORD.EXE 4256 WINWORD.EXE 4256 WINWORD.EXE 4256 WINWORD.EXE 4256 WINWORD.EXE 4256 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Licenses\1049\ReportViewerAddOnForVisualStudio2012.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCDE7C8.tmp\gb.xslFilesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
memory/4256-22-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-756-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-4-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-1-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-5-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-6-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-7-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-10-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-13-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-12-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-15-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-16-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-14-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-23-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-18-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-11-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-20-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-19-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-757-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-3-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-17-0x00007FFA60F20000-0x00007FFA60F30000-memory.dmpFilesize
64KB
-
memory/4256-24-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-25-0x00007FFA60F20000-0x00007FFA60F30000-memory.dmpFilesize
64KB
-
memory/4256-2-0x00007FFAA3A85000-0x00007FFAA3A86000-memory.dmpFilesize
4KB
-
memory/4256-527-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-672-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-673-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-674-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-675-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-676-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-680-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-687-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-688-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-0-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-759-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-758-0x00007FFA63A70000-0x00007FFA63A80000-memory.dmpFilesize
64KB
-
memory/4256-760-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-21-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB
-
memory/4256-761-0x00007FFAA39E0000-0x00007FFAA3BBB000-memory.dmpFilesize
1.9MB