e42821888f83e8e692739632c86323a7be1f0eecd36c34d8db26b6fc50ed052a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

英宇职业介绍管理系统/介绍信模板3.doc
Size

26KB
MD5

28913440361a6d43fb0a2b023dc82d2e
SHA1

1974b0c6bbb83cd5ee6945995a244eb74076995d
SHA256

8f020f18381bb842c7511ec5928c456efa6216e71bca09c2ae33632ec556a60f
SHA512

291dea152fde4c99930266fb0bfe3624527e5f7a7131f5c4ff4407352b424582273ffa6616df8d820893ac2a2d64e866024dde94eee46619d4655abf21a20671
SSDEEP

192:xqkrchCqlkkrIC4cKVDeSRlSIugBDpeFK92Mx2UX:xprGCkkkrICFKVDeSRcInBD4FK

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	WINWORD.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2312	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2312	WINWORD.EXE
2312	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2664	2312	WINWORD.EXE	31
PID 2312 wrote to memory of 2664	2312	WINWORD.EXE	31
PID 2312 wrote to memory of 2664	2312	WINWORD.EXE	31
PID 2312 wrote to memory of 2664	2312	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\英宇职业介绍管理系统\介绍信模板3.doc"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
31a80cd5028bd0ddc11965488a6696a3

SHA1
2b7990385b01667567756ec790763e721e89fdf6

SHA256
d841719eaed5c2696d3cce9d18af673e526f335524882fbd782af0f24c7790e2

SHA512
bf2d73f6cad0ee67b698b11280c1b9bd13c0c719315577d9cc099f432814ab6754d75f35935c418f38543cf1a9db0d34ba5fc2cf964d8051a3e06c572bf39b1d

Download Submit
memory/2312-0-0x000000002FAF1000-0x000000002FAF2000-memory.dmp

Filesize
4KB

Download
memory/2312-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2312-2-0x000000007111D000-0x0000000071128000-memory.dmp

Filesize
44KB

Download
memory/2312-10-0x000000007111D000-0x0000000071128000-memory.dmp

Filesize
44KB

Download
memory/2312-26-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download