0cd3055669bbfdac70ec3551654b90a1467eaf1e7abf76d8dc83c406454bad20

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/license.rtf
Size

24KB
MD5

afe456cadd057346a5a3641669068476
SHA1

1453d501d1b67056034f378951632eb74cd818a2
SHA256

c7e95b5cf475c946eb8c0168e7555697ded597ccb8fffb49c33cbffc5b8b33de
SHA512

541edac36325b995e3ed154c566d35720a1845fc3e2d66f18683562256125aee3adf54e6f2b982c999d71dec0a88eb4f1cf8635893f0061e1376e3f236658660
SSDEEP

384:OyU8jHYBAvr0QJes4Kza5rSOP6jL1VD+ep6D5vq9UFM/+aky:G87YBAT0QJeVKzatSOPcJ8ep6D0yT2

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2232	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2232	WINWORD.EXE
2232	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2752	2232	WINWORD.EXE	31
PID 2232 wrote to memory of 2752	2232	WINWORD.EXE	31
PID 2232 wrote to memory of 2752	2232	WINWORD.EXE	31
PID 2232 wrote to memory of 2752	2232	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$TEMP\license.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
e3af55986f7c898ab2e9cdf409159caf

SHA1
159920b5a3ca076d5426dee6ed843f735aeee589

SHA256
c316199313a36641c479e736601f6e4bc05dfb2f844d4c518ac41a868bd82918

SHA512
7a2269acacf7f5bb886412fc02626fabc2b6408d5d57639626eb5a4c47865a939dd4b05145b9bc79ad1a91df35d24733ce287099d78486406aeb1c540003fa27

Download Submit
memory/2232-0-0x000000002F371000-0x000000002F372000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2232-2-0x0000000070DFD000-0x0000000070E08000-memory.dmp

Filesize
44KB

Download
memory/2232-11-0x0000000070DFD000-0x0000000070E08000-memory.dmp

Filesize
44KB

Download
memory/2232-29-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2232-30-0x0000000070DFD000-0x0000000070E08000-memory.dmp

Filesize
44KB

Download