e42821888f83e8e692739632c86323a7be1f0eecd36c34d8db26b6fc50ed052a

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

英宇职业介绍管理系统/介绍信模板1.doc
Size

20KB
MD5

9fd968220b7dee78e526f3d6499819a2
SHA1

9aa171556631a3c349b7cec0c4d41f281d57da2a
SHA256

ae62d6cfce8284694966abb081dbad4c79d12f5f15b8cccbea4523efaa251da1
SHA512

b5bb0e5cfcdf865b20407f4c7d8cf559c4a93e9f826c37349fdb1b5e2abcfd2798d32dd3dc75a25ff5037b3455a25e2983ac0bcdc2598090119c1f5c4406ccb1
SSDEEP

96:OyMGgpuqcmsIQe/4uCYe/2QE0GbTP6TXvH7hj5qmHfLrsUYDq2VXDQzc:ODxcmUe/45Ye/2+GbMdjwUT2m

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	WINWORD.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2060	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2060	WINWORD.EXE
2060	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2836	2060	WINWORD.EXE	31
PID 2060 wrote to memory of 2836	2060	WINWORD.EXE	31
PID 2060 wrote to memory of 2836	2060	WINWORD.EXE	31
PID 2060 wrote to memory of 2836	2060	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\英宇职业介绍管理系统\介绍信模板1.doc"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
0c944c70ba424ec94cb754ecd115a760

SHA1
a3fa790ab5d2b26723b9087bbedd28ab08001ead

SHA256
12401f764b338722c96371917d820399af01f9a9d2aad739f600443c422307dd

SHA512
d5530ec6c1813e29ce9c26f230706218584753ef3dc90b4462255d5bb9296469075947bf3854756639ed60f59ba1b9e9286e452740fafa3715f64d9fbd4f93bd

Download Submit
memory/2060-0-0x000000002F341000-0x000000002F342000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2060-2-0x0000000070B6D000-0x0000000070B78000-memory.dmp

Filesize
44KB

Download
memory/2060-9-0x0000000070B6D000-0x0000000070B78000-memory.dmp

Filesize
44KB

Download
memory/2060-25-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download