Overview

overview

10

Static

static

10

Challenge_...m.docx

windows7-x64

4

Challenge_...m.docx

windows10-2004-x64

5

Challenge_...1.docx

windows7-x64

4

Challenge_...1.docx

windows10-2004-x64

1

Challenge_...y.docx

windows7-x64

4

Challenge_...y.docx

windows10-2004-x64

1

Challenge_...1.docx

windows7-x64

4

Challenge_...1.docx

windows10-2004-x64

1

tools/numb...ing.py

ubuntu-18.04-amd64

1

tools/numb...ing.py

debian-9-armhf

1

tools/numb...ing.py

debian-9-mips

1

tools/numb...ing.py

debian-9-mipsel

1

decoder_add1.py

ubuntu-18.04-amd64

1

decoder_add1.py

debian-9-armhf

1

decoder_add1.py

debian-9-mips

1

decoder_add1.py

debian-9-mipsel

1

decoder_ah.py

ubuntu-18.04-amd64

1

decoder_ah.py

debian-9-armhf

1

decoder_ah.py

debian-9-mips

1

decoder_ah.py

debian-9-mipsel

1

decoder_chr.py

ubuntu-18.04-amd64

1

decoder_chr.py

debian-9-armhf

1

decoder_chr.py

debian-9-mips

1

decoder_chr.py

debian-9-mipsel

1

decoder_rol1.py

ubuntu-18.04-amd64

1

decoder_rol1.py

debian-9-armhf

1

decoder_rol1.py

debian-9-mips

1

decoder_rol1.py

debian-9-mipsel

1

decoder_xor1.py

ubuntu-18.04-amd64

1

decoder_xor1.py

debian-9-armhf

1

decoder_xor1.py

debian-9-mips

1

decoder_xor1.py

debian-9-mipsel

1

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2023 22:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Challenge_FIles/income_tax_and_benefit_return_2021.docx

  • Size

    23KB

  • MD5

    55998cb43459159a5ed4511f00ff3fc8

  • SHA1

    9bec2182cc5b41fe8783bb7ab6e577bac5c19f04

  • SHA256

    d0e1f97dbe2d0af9342e64d460527b088d85f96d38b1d1d4aa610c0987dca745

  • SHA512

    8f04951f9efb5acdad0a625d9f63154089d552fe4281ca53a759cc0a0468b8d9c76af863e34ed6e00802225a4408bcda1110a6efce30357e6173973ea5bf7838

  • SSDEEP

    384:Q6UDg00MWEg9fPCPyH111/elBqhveoNHfn5yAehqbhtgyhdCxi556BjsbIwRq:QcMWE04uebyvNv5yHcttg6dwc5YQb5w

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Challenge_FIles\income_tax_and_benefit_return_2021.docx"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
    Filesize

    20KB

    MD5

    503384b0a02cdc570cbc62db5bc38f73

    SHA1

    c14e95303b8517401b6caad5328d51b6bd24dca2

    SHA256

    e130f914d8a793db0c5fd429b2bf6fac95986ded2d7e40a7d19eab01a49d2da6

    SHA512

    d47163dd7838b666f1562f10808f748bf28b354189cb5bf5e7b394d9d0e6494ff9b940171713b298376d6cb48097b907346d421a9be3278c7f23addae2202c46

    Download Submit
  • memory/2676-53-0x000000002F880000-0x000000002F9DD000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/2676-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2676-55-0x000000007125D000-0x0000000071268000-memory.dmp
    Filesize

    44KB

    Download
  • memory/2676-58-0x000000002F880000-0x000000002F9DD000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/2676-59-0x000000007125D000-0x0000000071268000-memory.dmp
    Filesize

    44KB

    Download
  • memory/2676-75-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2676-76-0x000000007125D000-0x0000000071268000-memory.dmp
    Filesize

    44KB

    Download