5271e8ec687c71a26214ccdba7c9ab1b60569bd5a3b56bfba8a6d5f1a6940dbd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rtf
Size

27KB
MD5

c7736898053907366b4ced5299198325
SHA1

adbb73abe177cada5e511b0b6921b7bd1a634170
SHA256

84426d0da029d70e2e503dc2c6ef1d092d5293e60504443b6f896dcc349bcbd6
SHA512

e559fe82cdb84e4f25f592b505aa373490e380d4674c173381b360eb2942e17ef8ac8c66b20f484767c340169a5e0efdfa5fd4a2863786d6418bda3526e1289b
SSDEEP

192:ZsQlCQ32AB93ryt0N/yPfyZQ/oi+Y7F5ztvqlpGWuRXg4tmN:ZsQcQ3GWKTt0QhXgKmN

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2088	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2088	WINWORD.EXE
2088	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2788	2088	WINWORD.EXE	30
PID 2088 wrote to memory of 2788	2088	WINWORD.EXE	30
PID 2088 wrote to memory of 2788	2088	WINWORD.EXE	30
PID 2088 wrote to memory of 2788	2088	WINWORD.EXE	30

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
b130457ae3677400c78a9b0a234cadf2

SHA1
7594ba966a4f0c0b619b1112218a79b6f0bdadb8

SHA256
ac078b33412e28fe8819953511141c35d514c7007ea9517b6bcf759da7654f9b

SHA512
cb0be0742220fa551dbcb8d2edee4fffd462a6e03d23271c90c1f9be6bb852c48b094fc21e181255e21b96b242a59d2b69ec5cfe3b83c4370e2320d358cd058c

Download Submit
memory/2088-0-0x000000002F831000-0x000000002F832000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2088-2-0x000000007114D000-0x0000000071158000-memory.dmp

Filesize
44KB

Download
memory/2088-5-0x000000007114D000-0x0000000071158000-memory.dmp

Filesize
44KB

Download
memory/2088-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2088-24-0x000000007114D000-0x0000000071158000-memory.dmp

Filesize
44KB

Download