Analysis
-
max time kernel
59s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 21:31
Behavioral task
behavioral1
Sample
c4fb497effaa65225ba4632d7ec1fc9059d8c43a54de1a005dc88da936a19072.doc
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c4fb497effaa65225ba4632d7ec1fc9059d8c43a54de1a005dc88da936a19072.doc
Resource
win10v2004-20240709-en
General
-
Target
c4fb497effaa65225ba4632d7ec1fc9059d8c43a54de1a005dc88da936a19072.doc
-
Size
159KB
-
MD5
9ba346e48e10d14dacc29c5b8f0be5e2
-
SHA1
6e478582c5bd78ab8dcb9e3100f685c9597cb140
-
SHA256
c4fb497effaa65225ba4632d7ec1fc9059d8c43a54de1a005dc88da936a19072
-
SHA512
3f8d2f9be6e0b3c838ac1ab1157cd2a39b8aa94e808f8557f51a16dc895a00054b8944038d449d85d55631ff1535878af11f8cfc3197b883d41c7b619dc3ebdf
-
SSDEEP
768:5Mk3yA1HzkP3L07eEASmcLvJ/FnVdl8npio:5MAyQkD0yzV2xNzW
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1016 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1016 WINWORD.EXE 1016 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1428 1016 WINWORD.EXE 33 PID 1016 wrote to memory of 1428 1016 WINWORD.EXE 33 PID 1016 wrote to memory of 1428 1016 WINWORD.EXE 33 PID 1016 wrote to memory of 1428 1016 WINWORD.EXE 33
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c4fb497effaa65225ba4632d7ec1fc9059d8c43a54de1a005dc88da936a19072.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84