66d8a0c3eba5f092d2d4fb040510d9fdf8315a8604b89d3f351d9aaa3ae0ef14

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OfficeSetup.exe
Size

7.1MB
MD5

776521fe89ae58ca5bad5881eb95d70d
SHA1

92a2c322651fcc44510b81d72d2fc8138d71d839
SHA256

66d8a0c3eba5f092d2d4fb040510d9fdf8315a8604b89d3f351d9aaa3ae0ef14
SHA512

60084e621c1513e9d02b2dea6940716cf8e734e24ab4a890003b37ff3fd4dff0bd03579e9f4dc4631b3209dabb0b43c479f0c10fe89d4cfa8cc3a82a70a03f18
SSDEEP

196608:j9Ttw0E4FuZRD/wpWRnDIorJvuhZ8jqRUpmKTz:jXw0mRMWhDIoN4RUpmK3

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation	OfficeSetup.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	2168	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1200	2168	OfficeSetup.exe	28
PID 2168 wrote to memory of 1200	2168	OfficeSetup.exe	28
PID 2168 wrote to memory of 1200	2168	OfficeSetup.exe	28
PID 2168 wrote to memory of 1200	2168	OfficeSetup.exe	28

C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OfficeSetup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 512
  2⤵
  - Program crash
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...