e731d83a480504848ba72ce344895dc2b75e5e9bf5e4a2f5bbdd1382656521d2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license_MLPC.rtf
Size

48KB
MD5

281d9ee1023a271ae94baa4f5311d642
SHA1

e6f5436a259e38c2ba6ce1836cce802d68bea3c3
SHA256

759b483399086ba4ed71d29144a8be3a46cf5a6dacca1c4f3c2d369c20f203f3
SHA512

f06e2462688dfbbc22895b9109ceb651e44ea1cb8d47be213b31c98aabd8a76a93b004c7cc53db8e8efd77782f51b667363ada6709e1d1aefb16ba3cc71a7fee
SSDEEP

768:I9rCh1UH4PgB4/Js24HbovQRDS7RK5rQvYXS77K5rQvYXS7UK5rQvYXS7TGl0nuG:+xDhEIl4BUrmuPSthlyCimOLUBu

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2576	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	WINWORD.EXE
2576	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2244	2576	WINWORD.EXE	31
PID 2576 wrote to memory of 2244	2576	WINWORD.EXE	31
PID 2576 wrote to memory of 2244	2576	WINWORD.EXE	31
PID 2576 wrote to memory of 2244	2576	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_MLPC.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
d04ae2590dfbc469e6ae9dd75e6e9564

SHA1
362dd40adce3723ec86172c4ff757d61ccdd3729

SHA256
03c349510c71f7cfd189d1406357a9842b1abfb4c3faaaa79b9fe6dfeeed4a5b

SHA512
f518a44a1e276fa706379628793b0d9e5a9f761d419d75705c0cb90addd9143f7075f67611284dc7d23890637c013ab89144fbbf0197ca7f81730ec2b8287dad

Download Submit
memory/2576-0-0x000000002FF81000-0x000000002FF82000-memory.dmp

Filesize
4KB

Download
memory/2576-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2576-2-0x0000000070CAD000-0x0000000070CB8000-memory.dmp

Filesize
44KB

Download
memory/2576-9-0x0000000070CAD000-0x0000000070CB8000-memory.dmp

Filesize
44KB

Download
memory/2576-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download