e42821888f83e8e692739632c86323a7be1f0eecd36c34d8db26b6fc50ed052a

Analysis

max time kernel
101s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

英宇职业介绍管理系统/人才库汇总表页脚.rtf
Size

901B
MD5

a3d49dcb56d70a66322823059d573910
SHA1

9b1e4ab021b43b00b044dd2d45fbe4b7ec3b8143
SHA256

0ba861fe127dcbfcf1cdfaf84a0b45c9785f1d49cfb09e8c6c97eb08182bf12a
SHA512

48d0f1dd4f3d9a6e9fa834c623b5a111bd206e2d4d2b0ce63af2a22e548874af3fe64ec3a87f6724bc7cf503dab7fc9147a499cfd045bde6b33b6ae12d8cacdf

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2340	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2340	WINWORD.EXE
2340	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2880	2340	WINWORD.EXE	28
PID 2340 wrote to memory of 2880	2340	WINWORD.EXE	28
PID 2340 wrote to memory of 2880	2340	WINWORD.EXE	28
PID 2340 wrote to memory of 2880	2340	WINWORD.EXE	28

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\英宇职业介绍管理系统\人才库汇总表页脚.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
9ecb25ce6508003eb97a5839354e738a

SHA1
d9e216805d5870db724b690cd9f90a17485f96f9

SHA256
c21f7d30b9669aa86f924abc8dda2bbed650c4cdf0d42cd230cf87dc7543ada9

SHA512
da63223a8db598396a845fd0def4602e21a510c8fcb85703b924d5ae7991b92e0d4c1d4eabeceb9cbb76b2d827e0c661b74506f6b1b2cbff1dae92d6c0c12ce2

Download Submit
memory/2340-0-0x000000002F7C1000-0x000000002F7C2000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2340-2-0x000000007175D000-0x0000000071768000-memory.dmp

Filesize
44KB

Download
memory/2340-11-0x000000007175D000-0x0000000071768000-memory.dmp

Filesize
44KB

Download
memory/2340-29-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download