zeus | 6352bd529a97e884f41811ed281af8a0c65d5eaef069cec388bb265e47edb279

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2b90664072ed53ad1ce9985e05ddc82_JaffaCakes118.rtf
Size 9KB
Sample240907-ypys7asalm
SHA256 6352bd529a97e884f41811ed281af8a0c65d5eaef069cec388bb265e47edb279
MD5 d2b90664072ed53ad1ce9985e05ddc82
SHA1 43dae7d98fafd94a6853f61d36d80497d6010c85
SHA512 018f836e8823d3e715b5f77c67c0260c0d4bcf1886ff454f0319aa5850dc276233ac918df1c1a4f8a5e0b5f70a850b47340836470d3f502dcfedacd993ebbefd
SSDEEP 96:SWnhBjrgKZDq5JRTA0M7QKQKGhkVaHbpTE2bzCAuECSEC1EC2WFBwZ3K5RECsP:SWbjESm5DTA03RqeAELEkE7WNjEB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zeus discovery

Malware Config

Signatures

Zeus
zeus

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2460	WINWORD.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2460	WINWORD.EXE
2460	WINWORD.EXE
2460	WINWORD.EXE
2460	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2904	2460	WINWORD.EXE	33
PID 2460 wrote to memory of 2904	2460	WINWORD.EXE	33
PID 2460 wrote to memory of 2904	2460	WINWORD.EXE	33
PID 2460 wrote to memory of 2904	2460	WINWORD.EXE	33

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d2b90664072ed53ad1ce9985e05ddc82_JaffaCakes118.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 2a4beffb87998bd6c416abc86ea79363506b1b942ca3973fea476fa504e63fe3
MD5 795cc35dee317112e42e7d59515b8a46
SHA1 defab1491ec44a0551ccd271a156e82159fa43ad
SHA512 d88b29c1285e46d7d2bf622e4086d3bf961d0852cf10e24b52008b9c01a0976ab08c21de443479bf97843bb1fdd5bc430f54c951b69d9b282abb18928f19af86
MD5 SHA1 SHA512

Submit Download

CabFC0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabFC0E.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

KQVJEW20UFDFJVA.sct

Path C:\Users\Admin\AppData\Local\Temp\KQVJEW20UFDFJVA.sct
Size 1KB
SHA256 1a60705009f02e0ea42a0369361a6862f6c6fee01ef1e944f0cd437041a23e92
MD5 8003dc425c275c7b861dcb2292da595a
SHA1 e7eee4ee296ea03637ce66636cbd83101a021c61
SHA512 460aa4939ce0b32618339cccd7db4086926893d5cb89419797523f81c34da2bb674cc9bce212a631ca43407c7c568a94f145ad772755bd1bbf692c1dfb98985d
MD5 SHA1 SHA512

Submit Download

TarFC40.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarFC40.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2460-0-0x000000002FA61000-0x000000002FA62000-memory.dmp

Download

memory/2460-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2460-2-0x00000000715FD000-0x0000000071608000-memory.dmp

Download

memory/2460-202-0x00000000715FD000-0x0000000071608000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads