e42821888f83e8e692739632c86323a7be1f0eecd36c34d8db26b6fc50ed052a

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

英宇职业介绍管理系统/介绍信模板2.doc
Size

25KB
MD5

be8122628bf2ff233586b548440a5796
SHA1

136629c271d4bd47b8f842a92caf09ec8eda13df
SHA256

28a420c775c70071e9836f766769d732b328c16a4a5100c567ce4b6f87fdd4ea
SHA512

d3c5fb435d88e210e820cd1ace767c1666bd5f4c2e4d19cfec21f0a798245f795fbd50cd1cd84cd7a281a9963d2cbafa8673ec8c8044279526e8ed075dab1c97
SSDEEP

192:QPqlBe/4776ulvLE4bNLMQZva9BBrwsg:QPkBb6uphN4QZyBBr

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	WINWORD.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2828	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	WINWORD.EXE
2828	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2604	2828	WINWORD.EXE	31
PID 2828 wrote to memory of 2604	2828	WINWORD.EXE	31
PID 2828 wrote to memory of 2604	2828	WINWORD.EXE	31
PID 2828 wrote to memory of 2604	2828	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\英宇职业介绍管理系统\介绍信模板2.doc"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
1c525de4c1c21a0ef5d1d20be8ad9c05

SHA1
4fdb66bffba134f355f8bf06dc1bfc05048d9ad2

SHA256
f82014596aef5de39eb752932b07997b57a3d2543dd9c15c5ef59d552e503a31

SHA512
1f777faf2e9a8e723d572fd4fdf1c177b1917932ce4cca6e76417e5fbb2e65e3199396df199ea5fdf9b13c0f9c15e1c472edffffe6fab2ddb3aa42aebd6a7498

Download Submit
memory/2828-0-0x000000002F871000-0x000000002F872000-memory.dmp

Filesize
4KB

Download
memory/2828-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2828-2-0x000000007157D000-0x0000000071588000-memory.dmp

Filesize
44KB

Download
memory/2828-5-0x000000007157D000-0x0000000071588000-memory.dmp

Filesize
44KB

Download
memory/2828-21-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download