a72fce930aabd756888fba61e928e57446609bc011874f778132996ebbdc6b5c

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Readme.rtf
Size

1KB
MD5

2d5fa335f4e0484d9604c748075c04a5
SHA1

c50481afc3a714285d0c52de67d28a3968ab3ee0
SHA256

981a0aebab3494d291ee0cddfd1d131d583c2f5effce12985da0899ca3448088
SHA512

7c12260e431ac4d3b92973a8faa0b1291c6107f9a587d61cc9954ff143c3f0fc23f6914a48433285a5c989349333c759820b837a01b6529d3a36b22f2c1755a2

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2992	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2992	WINWORD.EXE
2992	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2420	2992	WINWORD.EXE	32
PID 2992 wrote to memory of 2420	2992	WINWORD.EXE	32
PID 2992 wrote to memory of 2420	2992	WINWORD.EXE	32
PID 2992 wrote to memory of 2420	2992	WINWORD.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Readme.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
c88d2a6e1530023debfac601532fecec

SHA1
07f12e3dcb3f4101865e176c6513d027f039af2d

SHA256
c55100e2bdb5aae3662aabb8123e73442bc08d7dc1bf87583216e6e25b351177

SHA512
c2538c6f59a0b30d7ea0ac53982dd81235117e5cb6f0d9b435171e64b3f9e82abbfb6f1d235b4a9d23eeca40e27ad74592f37c5bd7888dc71edfd49ae1e469a1

Download Submit
memory/2992-0-0x000000002FB91000-0x000000002FB92000-memory.dmp

Filesize
4KB

Download
memory/2992-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2992-2-0x00000000710AD000-0x00000000710B8000-memory.dmp

Filesize
44KB

Download
memory/2992-10-0x00000000710AD000-0x00000000710B8000-memory.dmp

Filesize
44KB

Download
memory/2992-28-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download