Analysis
-
max time kernel
124s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 02:08
Static task
static1
Behavioral task
behavioral1
Sample
02072024_0208_01072024_Bank slip.docx
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
02072024_0208_01072024_Bank slip.docx
Resource
win10v2004-20240508-en
General
-
Target
02072024_0208_01072024_Bank slip.docx
-
Size
16KB
-
MD5
d23ad6c57a2e42bc4d01a63c7957047a
-
SHA1
0e6de0feaa8e9471395943675fdd2da07576c1bd
-
SHA256
9d2722eed882f96fbe2c0cab9297cd0f8b180add761b034be81ebbed18acb33a
-
SHA512
63fb9186a83f9c917ad110f986deb08fb36b4eaa3a254f4c421a55a85b21c6c976ac54ad41f0781095cc8125119838a489ad218bd274025a1a917b398392aa50
-
SSDEEP
384:WyXHNatWqs8PL8wi4OEwH8TIbE91r2fRqJY8cviCv4zxUBZ72:WcHqx5P3DOqnYJUYvrv4lx
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4348 WINWORD.EXE 4348 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WINWORD.EXEdescription pid process Token: SeAuditPrivilege 4348 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 4348 WINWORD.EXE 4348 WINWORD.EXE 4348 WINWORD.EXE 4348 WINWORD.EXE 4348 WINWORD.EXE 4348 WINWORD.EXE 4348 WINWORD.EXE 4348 WINWORD.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\02072024_0208_01072024_Bank slip.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3768,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\obizxcv[1].docFilesize
435KB
MD5772118c84cda70602577a54f7a565949
SHA1ebda11d7f40bfd5b0e41ce2e3d8e66cc1c5044cb
SHA256f161926d1afc3b1592008ae8582f4e2857ac658bf52c91a111127a2fcfc2ebdb
SHA51269330901c62c60387bc067729eb1e0e382045697745988c88fb88817ee67aab4779fff720944c85dd2d8b775e6b987ccff140d27eca402e18be7c780c27645fb
-
C:\Users\Admin\AppData\Local\Temp\TCD7BAC.tmp\gb.xslFilesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
245B
MD5074b768e65d2946ea83c3ee95cdc13ae
SHA1b289e75a2d17ecf15354dc24d2e3d6cde52cff0d
SHA256d0d5b3a6875013c896a7ecbf6e8d1688391a84c5e25656aa3cffaac7d85b02cc
SHA51230a97ba597620a7ad851edb4bebe624f5e18f5e60eeb895f706323612b1c458dbd5d393acbddde15d9511157ee5906b1d58c81837060b24f5328ed0b930fa567
-
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lexFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/4348-7-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-21-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-6-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-8-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-0-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-9-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-11-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-12-0x00007FFEF2CF0000-0x00007FFEF2D00000-memory.dmpFilesize
64KB
-
memory/4348-10-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-13-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-14-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-15-0x00007FFEF2CF0000-0x00007FFEF2D00000-memory.dmpFilesize
64KB
-
memory/4348-17-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-20-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-22-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-5-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-19-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-18-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-16-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-1-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-3-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-4-0x00007FFF34ECD000-0x00007FFF34ECE000-memory.dmpFilesize
4KB
-
memory/4348-84-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB
-
memory/4348-2-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-589-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-588-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-590-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-591-0x00007FFEF4EB0000-0x00007FFEF4EC0000-memory.dmpFilesize
64KB
-
memory/4348-592-0x00007FFF34E30000-0x00007FFF35025000-memory.dmpFilesize
2.0MB