Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    19-07-2024 21:11

General

  • Target

    6b4061021a795bade0cf80a28d461136f9032d24937ebf360bc6d667ad43af7f.doc

  • Size

    16KB

  • MD5

    fcb892eebce485b4161ee08b6b405ddf

  • SHA1

    86e97121cc8c527b83508ff2f5c5f36621b94722

  • SHA256

    6b4061021a795bade0cf80a28d461136f9032d24937ebf360bc6d667ad43af7f

  • SHA512

    24ccf0c06374e194a162178ac8b1c35cfc3970f916fc5f69166c8835efd6d4240aee85adca9b1432d18ef80983a67efadefc42b8af2aa362908a1424979bf472

  • SSDEEP

    96:D6qOpM9SVDXAMaMwMlU9nNe2LnPUfo1S7UXu9ryG/15hKThSB58Ac:DabDAH7zeimoIpDh4UB58Z

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6b4061021a795bade0cf80a28d461136f9032d24937ebf360bc6d667ad43af7f.doc"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2412

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f153e341ccb4d91361f9fa9f3bd80ac4

      SHA1

      1945a4d8725d390ba30ab2c8bd734e8ab2c4ecf8

      SHA256

      617cf28ea8f4048eda92a057ee0104e1822d5e397f806a6b00b6a0ef47d5a9a9

      SHA512

      2bfe192870b92cc1d001d96a30700f8546079bd4fcdb50aa3495a4f8f551a276a1988383cfb408c128430d046ffe9aa5fd71f8d5282e5d0ebec0ed671559a289

    • C:\Users\Admin\AppData\Local\Temp\CabB9E0.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarBA02.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      cc24138e7e5b5febae252b8e526f6cde

      SHA1

      9d941479f8fabed6b38c1f0710ea55f329a43ca8

      SHA256

      10ab04522e5563833b3d29a86f47bb9e93034c63545800d9a30c8b59d2f12ba2

      SHA512

      26fb7211b2edc0e163728606dd2e882ae2422bd51e83570b10de7bdc40f282a3ba3697afb116d5d2c22bb2f21a36e347d3e26176b0ae56df9e187adbd6798c43

    • memory/1688-0-0x000000002FBB1000-0x000000002FBB2000-memory.dmp

      Filesize

      4KB

    • memory/1688-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1688-2-0x0000000070B3D000-0x0000000070B48000-memory.dmp

      Filesize

      44KB

    • memory/1688-144-0x0000000070B3D000-0x0000000070B48000-memory.dmp

      Filesize

      44KB

    • memory/1688-159-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1688-160-0x0000000070B3D000-0x0000000070B48000-memory.dmp

      Filesize

      44KB