f98f66d49c75e1d672d7eed1b72348079d4b303021d29a4e72a849c5c0497ffb

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license_rs.rtf
Size

34KB
MD5

0fd9d843efc7d991fd8d6fc903103820
SHA1

2ec67ade65ab35c6e4c4415cf2479597ea2c32ff
SHA256

3797dcef5b988f62e819d152f7fd2d66c370b924ff9fad4bbefee182a2031888
SHA512

9f2c59de31a322d260918e3baef9b5582c326d127b938b78d0ee24400da1a465397206d26b69a16b2f4ec18490b56e23a78e0b679a8d24ff9d14395628cc0aac
SSDEEP

384:mjZoBCb5NHlNnUy9h2SNAca+v+I7e8YWSAZpyYL6ChVoyGkvumFp2:dyvnVa+G5A4

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2800	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2800	WINWORD.EXE
2800	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2852	2800	WINWORD.EXE	32
PID 2800 wrote to memory of 2852	2800	WINWORD.EXE	32
PID 2800 wrote to memory of 2852	2800	WINWORD.EXE	32
PID 2800 wrote to memory of 2852	2800	WINWORD.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_rs.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
a8464a3c7286f43a4c689c6e3b8b0eaf

SHA1
64eed3023553f8b879d67680eee42caf42b0e454

SHA256
9cbce3a885cd9abf8726ea944281ad93c84250ca54168ce78308bc77c5ea8f39

SHA512
8a4b86e6367319b59f52cd8717f85f6d58f2f2904499741e2d02a7a2cdd3326f39fe01520326a6d4c226712afdf70ade349d5e80d3ac311f0cbf223f309c9a6b

Download Submit
memory/2800-0-0x000000002F7A1000-0x000000002F7A2000-memory.dmp

Filesize
4KB

Download
memory/2800-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2800-2-0x0000000070C6D000-0x0000000070C78000-memory.dmp

Filesize
44KB

Download
memory/2800-5-0x0000000070C6D000-0x0000000070C78000-memory.dmp

Filesize
44KB

Download
memory/2800-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download