bd314118222f12342e94ccaff3a2746862c9122ae4cf94f6890fe0d6658ad573

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license_MLPC.rtf
Size

48KB
MD5

281d9ee1023a271ae94baa4f5311d642
SHA1

e6f5436a259e38c2ba6ce1836cce802d68bea3c3
SHA256

759b483399086ba4ed71d29144a8be3a46cf5a6dacca1c4f3c2d369c20f203f3
SHA512

f06e2462688dfbbc22895b9109ceb651e44ea1cb8d47be213b31c98aabd8a76a93b004c7cc53db8e8efd77782f51b667363ada6709e1d1aefb16ba3cc71a7fee
SSDEEP

768:I9rCh1UH4PgB4/Js24HbovQRDS7RK5rQvYXS77K5rQvYXS7UK5rQvYXS7TGl0nuG:+xDhEIl4BUrmuPSthlyCimOLUBu

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
588	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
588	WINWORD.EXE
588	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 2388	588	WINWORD.EXE	31
PID 588 wrote to memory of 2388	588	WINWORD.EXE	31
PID 588 wrote to memory of 2388	588	WINWORD.EXE	31
PID 588 wrote to memory of 2388	588	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_MLPC.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
4a09faf4ec974fd69a183686b23b99b3

SHA1
0a06c47422df03f62288313e18d2644e0877137d

SHA256
3af88b9f4ff7e61dfded253542605c45293ef7f1b9499f27ce53e040f6049ce4

SHA512
2dae7fb3e31c5d8c70193506ed707a7d53e80182d836a916b4670bfe69374c0fa45e1837d218e0d902403d87328e7a9fd736ec3d07dcc3e3c27a7647af3fd3d1

Download Submit
memory/588-0-0x000000002FE41000-0x000000002FE42000-memory.dmp

Filesize
4KB

Download
memory/588-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/588-2-0x00000000711CD000-0x00000000711D8000-memory.dmp

Filesize
44KB

Download
memory/588-9-0x00000000711CD000-0x00000000711D8000-memory.dmp

Filesize
44KB

Download
memory/588-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download