34e47c717e108716736ce89d3e2fd8dccb7f7550b2340b1eb62610b71d585d79

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license_MLPC.rtf
Size

48KB
MD5

281d9ee1023a271ae94baa4f5311d642
SHA1

e6f5436a259e38c2ba6ce1836cce802d68bea3c3
SHA256

759b483399086ba4ed71d29144a8be3a46cf5a6dacca1c4f3c2d369c20f203f3
SHA512

f06e2462688dfbbc22895b9109ceb651e44ea1cb8d47be213b31c98aabd8a76a93b004c7cc53db8e8efd77782f51b667363ada6709e1d1aefb16ba3cc71a7fee
SSDEEP

768:I9rCh1UH4PgB4/Js24HbovQRDS7RK5rQvYXS77K5rQvYXS7UK5rQvYXS7TGl0nuG:+xDhEIl4BUrmuPSthlyCimOLUBu

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2372	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2372	WINWORD.EXE
2372	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2596	2372	WINWORD.EXE	32
PID 2372 wrote to memory of 2596	2372	WINWORD.EXE	32
PID 2372 wrote to memory of 2596	2372	WINWORD.EXE	32
PID 2372 wrote to memory of 2596	2372	WINWORD.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_MLPC.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
8fc92c1ed89746657c802a19d80d812c

SHA1
895027fe6314ab2c90768283661478a445a647d7

SHA256
910e14d154967c87c56de32e0db83219716e7dfb4d0809487eabe185327ec433

SHA512
ead826fa115e28454c46114294324e2e1545142772c6b3e287f28243f64ec561e2cd75a1fcfcd6dcefda70d79902d4460cf23e2acbe9b63d9a8dd0dec70a678c

Download Submit
memory/2372-0-0x000000002FA91000-0x000000002FA92000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2372-2-0x000000007121D000-0x0000000071228000-memory.dmp

Filesize
44KB

Download
memory/2372-9-0x000000007121D000-0x0000000071228000-memory.dmp

Filesize
44KB

Download
memory/2372-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download