ff0593ebf0842e4e36449b50d3debfa321152ae3169eb24be52afb5772495577

Resubmissions

09/08/2024, 00:02

240809-abhm2swglc 8

08/08/2024, 23:58

240808-31lp8asfqn 4

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CeleryApp.exe
Size

8.8MB
MD5

74c366b46a85acac6c83e9671e64dda7
SHA1

dc9a7b4cc7511b701401aa86e0106d3495e3a0fe
SHA256

6a25cc6c05e54ca56e8b51d2b2bd8b9a17a96ecb1d1f6d4442d36378dc809ed1
SHA512

e0df64a74c3c9e1c36f5957d346d961cc92741b1803e05d41454dde4371a0e9420f9e79163bed9fe2d8b588b9da6f2faaa08003ca50be37a6425a8320acd15cb
SSDEEP

98304:wEgLIRfyC7egWJ3iJzdjf4fwraOWcD9XdMPABIw/t6KHDicVwzUs7:wEguhegD4fJOWs9XNBZ16M2cuU

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2192	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2192	WINWORD.EXE
2192	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2216	3068	CeleryApp.exe	30
PID 3068 wrote to memory of 2216	3068	CeleryApp.exe	30
PID 3068 wrote to memory of 2216	3068	CeleryApp.exe	30

C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 860
  2⤵
  PID:2216

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CopyEnable.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
67f5412c86b4a2a838025763a30bafe2

SHA1
f6fdb9987e557b172a91e7358e1b7d9834a43d52

SHA256
ccec61a26aff84920c7a841376a9a7a7d7bec2cc63298d00833448cd13349065

SHA512
49cf5bb29b69ae8209edf62ce5b84f95ed77cd6cf011ce93fbfd57dead56887ea6508ad71e60dfd3f2489ea45ab33781b1f823e0a41de137c6f06c09c76a295e

Download Submit
memory/2192-15-0x000000002F1C1000-0x000000002F1C2000-memory.dmp

Filesize
4KB

Download
memory/2192-47-0x0000000071ABD000-0x0000000071AC8000-memory.dmp

Filesize
44KB

Download
memory/2192-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2192-17-0x0000000071ABD000-0x0000000071AC8000-memory.dmp

Filesize
44KB

Download
memory/2192-16-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3068-5-0x000000001DBC0000-0x000000001E4DE000-memory.dmp

Filesize
9.1MB

Download
memory/3068-12-0x0000000000F40000-0x0000000000F4A000-memory.dmp

Filesize
40KB

Download
memory/3068-8-0x0000000000F40000-0x0000000000F4E000-memory.dmp

Filesize
56KB

Download
memory/3068-9-0x000000001B980000-0x000000001B9F4000-memory.dmp

Filesize
464KB

Download
memory/3068-10-0x000007FEF6473000-0x000007FEF6474000-memory.dmp

Filesize
4KB

Download
memory/3068-11-0x000007FEF6470000-0x000007FEF6E5C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-13-0x0000000000F40000-0x0000000000F4A000-memory.dmp

Filesize
40KB

Download
memory/3068-6-0x0000000000F40000-0x0000000000F4A000-memory.dmp

Filesize
40KB

Download
memory/3068-14-0x000007FEF6470000-0x000007FEF6E5C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-7-0x0000000000F40000-0x0000000000F4A000-memory.dmp

Filesize
40KB

Download
memory/3068-0-0x000007FEF6473000-0x000007FEF6474000-memory.dmp

Filesize
4KB

Download
memory/3068-4-0x0000000002D40000-0x0000000002D90000-memory.dmp

Filesize
320KB

Download
memory/3068-3-0x0000000002C70000-0x0000000002CB0000-memory.dmp

Filesize
256KB

Download
memory/3068-2-0x000007FEF6470000-0x000007FEF6E5C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-1-0x0000000000010000-0x00000000008D6000-memory.dmp

Filesize
8.8MB

Download