e42821888f83e8e692739632c86323a7be1f0eecd36c34d8db26b6fc50ed052a

Analysis

max time kernel
100s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

英宇职业介绍管理系统/招聘信息汇总表页脚.rtf
Size

902B
MD5

4236ebae0221bac6dc3d6e5c8f30fa49
SHA1

e52da6d312a9c0752981b7825fea3188d51a3274
SHA256

8db9b25188c73b80388f2603adfe6c3f7e9143ed2092d2dee1674c9217a5b85b
SHA512

10541fb43cdecfb124de48c14fc678f81172bc57b966bbde962db10c43d27d1bbf2567a8c24d56a92cd028a7426f62b863b8a23c6c969fc3f4093c3422450a57

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
600	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
600	WINWORD.EXE
600	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 2100	600	WINWORD.EXE	30
PID 600 wrote to memory of 2100	600	WINWORD.EXE	30
PID 600 wrote to memory of 2100	600	WINWORD.EXE	30
PID 600 wrote to memory of 2100	600	WINWORD.EXE	30

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\英宇职业介绍管理系统\招聘信息汇总表页脚.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
b3994f48ba842c8397f656a527cb57dc

SHA1
f60389f6607b934f492274ab3744dd97405f9bc0

SHA256
32ccde1fb3beb4d42fd048a0ea004cf558555855f169d35f51f83b2907e8ccef

SHA512
82b05f1542050c66c6563e580b0db942e37911acfa2133b836ace06723ac3375814894cb6ffede4dab665d92ebba1227989a0063711cc9a42fc2cfe2235a1f6f

Download Submit
memory/600-0-0x000000002F101000-0x000000002F102000-memory.dmp

Filesize
4KB

Download
memory/600-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/600-2-0x0000000070ADD000-0x0000000070AE8000-memory.dmp

Filesize
44KB

Download
memory/600-9-0x0000000070ADD000-0x0000000070AE8000-memory.dmp

Filesize
44KB

Download
memory/600-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download