e8cf6f04b84b0e66e95bb2cfe521c67bfb2b026835747bc0e276594777edee7f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/license_cb.rtf
Size

35KB
MD5

16a09bff84c5cca2dabf0497d23a5f8d
SHA1

89681b2dd1299ed7dc881219a9de2c2119c86cb4
SHA256

3e6cc3a654a122b52f3905cdd3d07df3ca9c540d2f68bd64c91c783f576bed0a
SHA512

827a12d1edd6209e016d5c951b70a4dd754356503456e35a3d9196c495a67fc464900766adae8b342466b44130423501fd79f731f1534394ef83cd57fa46a009
SSDEEP

768:MIpQpky+9ZKx76b/Ve4pfMRkPJM/KwIf0YPJMizkQs2WtD08Z:qi+2WtL

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1764	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1764	WINWORD.EXE
1764	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2832	1764	WINWORD.EXE	32
PID 1764 wrote to memory of 2832	1764	WINWORD.EXE	32
PID 1764 wrote to memory of 2832	1764	WINWORD.EXE	32
PID 1764 wrote to memory of 2832	1764	WINWORD.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_cb.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
e4fff0ed53e91bbd9df7ee7598508a29

SHA1
729c0560e9f22ad30b2aa74adad8a7f9d0ce7e46

SHA256
b3699aa0f50e467c924c2e5c3b2561222b9d06441eeb135eb9290a9f5542cd39

SHA512
9abfe6d9e531df7ba80a7ab50161eebeb0793b670ec332f417e513b5536abcdc3d92c5477b95096ca5ca27b74d6f62a2391c7829134483af41debf7592a678c0

Download Submit
memory/1764-0-0x000000002F621000-0x000000002F622000-memory.dmp

Filesize
4KB

Download
memory/1764-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1764-2-0x00000000717CD000-0x00000000717D8000-memory.dmp

Filesize
44KB

Download
memory/1764-5-0x00000000717CD000-0x00000000717D8000-memory.dmp

Filesize
44KB

Download
memory/1764-24-0x00000000717CD000-0x00000000717D8000-memory.dmp

Filesize
44KB

Download
memory/1764-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download