2fc040143ffdf72ebff222147e437b59309325b89479f50f0d8fad6afbc5c25c

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/EULA.rtf
Size

8KB
MD5

b4785cdc8515a16ea0a4234dfbb10d6a
SHA1

a5dc6d5e69ee191972a31654118ffbc16a1ab4f7
SHA256

cbef17712f6c18c334fe010362dd0b8872d8a679cbd3f8e95780a05f92000048
SHA512

cd186e415a729381fa1d92aafe30f310ea5815c4d7e3a3c5eb9522cffece19e3034e8aeac8f859636b02868ee6037231c6d5d3e71cf74cb2919bda3c4060e6ad
SSDEEP

192:cklizMIg9sYnKgYEDN6RnHr9ejPqxkYhQ:c86McBgYOMRLon6Q

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1044	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	WINWORD.EXE
1044	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2756	1044	WINWORD.EXE	31
PID 1044 wrote to memory of 2756	1044	WINWORD.EXE	31
PID 1044 wrote to memory of 2756	1044	WINWORD.EXE	31
PID 1044 wrote to memory of 2756	1044	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EULA.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
06f7e93a85a39aaa31f85f009b4d7757

SHA1
1e7b1d85bdf59b850fb84d4c28046ed0ef6e90cb

SHA256
f304dbf204122c16d3bbe9a5c44b24164c8b214db5810ccdf07a459ffd7a832e

SHA512
629b6c37c012ca83667617ed2b4d2bec5c0bf0297ff3ca5d248d8e01b2ed1103b62eb5fd9422a656b33e8dda9480b0354b7e2743294e01c3fbeeb61f383065ab

Download Submit
memory/1044-0-0x000000002F7F1000-0x000000002F7F2000-memory.dmp

Filesize
4KB

Download
memory/1044-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1044-2-0x000000007310D000-0x0000000073118000-memory.dmp

Filesize
44KB

Download
memory/1044-5-0x000000007310D000-0x0000000073118000-memory.dmp

Filesize
44KB

Download
memory/1044-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download