e42821888f83e8e692739632c86323a7be1f0eecd36c34d8db26b6fc50ed052a

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

英宇职业介绍管理系统/介绍信查询汇总表页脚.rtf
Size

931B
MD5

74047e9134a5f1e5aaae523aa0741911
SHA1

c4ab294489f19e9fe6d9537ef137089aee17c093
SHA256

801a90438f4358b1caa458dae349c69abe90a269779d21d2b150141874bf8016
SHA512

9c8b8e4f25cdb5e6af91f296216c309eb073012816e600b20657b167a56cdb9e9a3f0af544398419176b6a89075278a64c4a1006a58d66603f1fe119c827d09a

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1936	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1936	WINWORD.EXE
1936	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3056	1936	WINWORD.EXE	31
PID 1936 wrote to memory of 3056	1936	WINWORD.EXE	31
PID 1936 wrote to memory of 3056	1936	WINWORD.EXE	31
PID 1936 wrote to memory of 3056	1936	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\英宇职业介绍管理系统\介绍信查询汇总表页脚.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
310d7aff1b115408cd445919cb7d2dc6

SHA1
01a3a5311e19ea54371e19db28e4eacd60b1f726

SHA256
e8852f15a759686f1d0f705a4b45abb4675a2f2b377eb4f4415579b53745e379

SHA512
17e126b16474dbd6bdeb2c6a3b0191fa4e57e1059d2c35f803f9cb3f0d3b8ed0674d4a5d0a2e3e26bb5474c0388ffb1d3e5336071cc49a25a5c5684fd2844dc1

Download Submit
memory/1936-0-0x000000002F211000-0x000000002F212000-memory.dmp

Filesize
4KB

Download
memory/1936-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1936-2-0x000000007138D000-0x0000000071398000-memory.dmp

Filesize
44KB

Download
memory/1936-9-0x000000007138D000-0x0000000071398000-memory.dmp

Filesize
44KB

Download
memory/1936-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download