f52a9ae7036a7e113d4ad84816694f9b713a9f1d82b279a126b295c9fa1d480b

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OfficeSetup.exe
Size

8.0MB
MD5

a00cc587fc5b60da836fae6f57e37215
SHA1

9f0f130231be528d9e1815f8fbde59d498d6af4b
SHA256

f52a9ae7036a7e113d4ad84816694f9b713a9f1d82b279a126b295c9fa1d480b
SHA512

988a87ab8466e6a951da4486ea5426f33f2679993c4654de591c55f5ec18b358ed8b56778f910302cf3073c8ab77fa1eb8465f2a81279626f4868dccd72c0a34
SSDEEP

196608:+Fhx3li/KRXxG2nZ000UMVZUMPRcmLup5+g/TpxI81Heyf:2i/QxGAZ0FVZUILup5fpx3Heyf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Control Panel\International\Geo\Nation	OfficeSetup.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2808	2280	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2808	2280	OfficeSetup.exe	28
PID 2280 wrote to memory of 2808	2280	OfficeSetup.exe	28
PID 2280 wrote to memory of 2808	2280	OfficeSetup.exe	28
PID 2280 wrote to memory of 2808	2280	OfficeSetup.exe	28

C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 528
  2⤵
  - Program crash
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads