f1a35e14ac13a6e686195edb94f749f4b256e74f38c03e450535765a179efcf7

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eula.rtf
Size

8KB
MD5

0f05a0df44c1dcd888ba5017a272be49
SHA1

8f044ffd7650a19db945504aa9b28bb8c8af9661
SHA256

3053fca4093ab4d271e30b7710e21b3e65065f40fd71b7d09af42f2f8e013a2c
SHA512

75f3fbfb2ce4b549921a80d1f22e3621cfb6bdeb0e532d497cfafec875e8c7f5a0dfb01afb9aa916c2a14e1875de5d9f74480dc8b1b5a2561fbdda6def7785cc
SSDEEP

96:IvHfIpJ/hygUwMTg9QWJIbSrf85t4Kq3Bbkgzh4eSJj/G0hGc3m8r:0qy5hTg9QRSg5tqtkYpSVpHtr

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2212	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	WINWORD.EXE
2212	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2816	2212	WINWORD.EXE	31
PID 2212 wrote to memory of 2816	2212	WINWORD.EXE	31
PID 2212 wrote to memory of 2816	2212	WINWORD.EXE	31
PID 2212 wrote to memory of 2816	2212	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eula.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
27f9eea111d6b5a04df0e256a2c2c374

SHA1
b0299ff8139bba70c8b0da9fd4e90f0d59234d54

SHA256
5316912a3645960e7526a802220080a684e6c6ca4aa5e9a496eaca8b80ecc40b

SHA512
bfdc5b775e108f01817449753d4164440d84ad00708e64f66a542444d6d9c0684831e783c5a10190a96e02f3d68c9937bf61595f0067f543f956f0875cd2b67a

Download Submit
memory/2212-0-0x000000002FC01000-0x000000002FC02000-memory.dmp

Filesize
4KB

Download
memory/2212-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2212-2-0x000000007123D000-0x0000000071248000-memory.dmp

Filesize
44KB

Download
memory/2212-9-0x000000007123D000-0x0000000071248000-memory.dmp

Filesize
44KB

Download
memory/2212-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download