e1755463ccbde71e60d8d3ed29b9843223305009167fd686191d93d217c3875f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license_MLPC.rtf
Size

48KB
MD5

281d9ee1023a271ae94baa4f5311d642
SHA1

e6f5436a259e38c2ba6ce1836cce802d68bea3c3
SHA256

759b483399086ba4ed71d29144a8be3a46cf5a6dacca1c4f3c2d369c20f203f3
SHA512

f06e2462688dfbbc22895b9109ceb651e44ea1cb8d47be213b31c98aabd8a76a93b004c7cc53db8e8efd77782f51b667363ada6709e1d1aefb16ba3cc71a7fee
SSDEEP

768:I9rCh1UH4PgB4/Js24HbovQRDS7RK5rQvYXS77K5rQvYXS7UK5rQvYXS7TGl0nuG:+xDhEIl4BUrmuPSthlyCimOLUBu

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1940	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1940	WINWORD.EXE
1940	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2760	1940	WINWORD.EXE	31
PID 1940 wrote to memory of 2760	1940	WINWORD.EXE	31
PID 1940 wrote to memory of 2760	1940	WINWORD.EXE	31
PID 1940 wrote to memory of 2760	1940	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_MLPC.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
eda36dfdbeecc3e3e683d23a39c1608e

SHA1
2425fae9f59818b4ce7cfd247387b406d2eed128

SHA256
a37ac531963b35b8715dbe1267582c9dedad0f939552cfd88d920471cb8ec586

SHA512
1fcd2f1ce62bbabcbfde41eda2b00224074d8b1de2c4b229daed81ede5506f0681f148f8203bf966d04369fd7c8998d8c5d1b582bc7544c115339a57323ead32

Download Submit
memory/1940-0-0x000000002FDC1000-0x000000002FDC2000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1940-2-0x00000000710FD000-0x0000000071108000-memory.dmp

Filesize
44KB

Download
memory/1940-5-0x00000000710FD000-0x0000000071108000-memory.dmp

Filesize
44KB

Download
memory/1940-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download