9447041d2e74175bf1aeb7437703a01e6badfd76dc355c51048b79b517755135

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license_MLPC.rtf
Size

48KB
MD5

281d9ee1023a271ae94baa4f5311d642
SHA1

e6f5436a259e38c2ba6ce1836cce802d68bea3c3
SHA256

759b483399086ba4ed71d29144a8be3a46cf5a6dacca1c4f3c2d369c20f203f3
SHA512

f06e2462688dfbbc22895b9109ceb651e44ea1cb8d47be213b31c98aabd8a76a93b004c7cc53db8e8efd77782f51b667363ada6709e1d1aefb16ba3cc71a7fee
SSDEEP

768:I9rCh1UH4PgB4/Js24HbovQRDS7RK5rQvYXS77K5rQvYXS7UK5rQvYXS7TGl0nuG:+xDhEIl4BUrmuPSthlyCimOLUBu

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2864	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2864	WINWORD.EXE
2864	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2684	2864	WINWORD.EXE	31
PID 2864 wrote to memory of 2684	2864	WINWORD.EXE	31
PID 2864 wrote to memory of 2684	2864	WINWORD.EXE	31
PID 2864 wrote to memory of 2684	2864	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_MLPC.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
4645ab486bfe23d73d417f59fb561e93

SHA1
4dc11fefa9fe45edf7bcba9e622e1a35da4ff9de

SHA256
4213c1f3e41afe4a6a5022104aec6c63bfa5b091e47c1ce4ef857bd67f37b03e

SHA512
5e464f3c4f56a5ace89cc735f188563020c05191085ae8b0508cada7f7512498f61b0020ecb670470c24b0b361518687b4cb54fc71f0aeb02810934a5c9b565d

Download Submit
memory/2864-0-0x000000002F7E1000-0x000000002F7E2000-memory.dmp

Filesize
4KB

Download
memory/2864-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2864-2-0x00000000716AD000-0x00000000716B8000-memory.dmp

Filesize
44KB

Download
memory/2864-10-0x00000000716AD000-0x00000000716B8000-memory.dmp

Filesize
44KB

Download
memory/2864-28-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download