7dbbe22946c2437845591d5bcbddcc550a8bb16c8dba01e13e34cd52f3fc7c36

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license.rtf
Size

193B
MD5

beea38d906aecb227da5df5ab302290c
SHA1

33f1c86ed87c49a39e0d4a2a8302d2b970947133
SHA256

c45a69c256f70d5643d61870210cb0f21bd22cc07189d58e74c060e27f9bc6f4
SHA512

f9f001ed3406718300b4312e975834d5a7408c0e8318a5bdfb9c0d8da7918481e0cdaac9832e6841de21e25f1ced38cc18e13f2f5f6dc64065df975fbf7bdb9e

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2232	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2232	WINWORD.EXE
2232	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2760	2232	WINWORD.EXE	32
PID 2232 wrote to memory of 2760	2232	WINWORD.EXE	32
PID 2232 wrote to memory of 2760	2232	WINWORD.EXE	32
PID 2232 wrote to memory of 2760	2232	WINWORD.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
a8f98a012075c50730955fbde70be71d

SHA1
28e074da53833763121028ecfe3e81c7cb3056f4

SHA256
516339d158776b57a46da6d7c14f0e06a106831b356cfecdedf715ea763b452f

SHA512
6ca09ce5fb6b34688a1d9f09d3a6f88f84178f5588a7094d08903efeab132fe5c0106f3032dd03030d3920dbd5e6477d6727d45f401e90cda1dacce626ee4c98

Download Submit
memory/2232-0-0x000000002F141000-0x000000002F142000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2232-2-0x0000000070B3D000-0x0000000070B48000-memory.dmp

Filesize
44KB

Download
memory/2232-9-0x0000000070B3D000-0x0000000070B48000-memory.dmp

Filesize
44KB

Download
memory/2232-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download