Overview
overview
10Static
static
3407749c986...2N.exe
windows7-x64
7407749c986...2N.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/windll.dll
windows7-x64
10$TEMP/windll.dll
windows10-2004-x64
10$TEMP/word....0.exe
windows7-x64
7$TEMP/word....0.exe
windows10-2004-x64
7Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
407749c9862fa3fd6219065cb7ccd4f135a06dbcb7d69342b9badda9273fa292N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$TEMP/windll.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$TEMP/windll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$TEMP/word-repair-software-3.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$TEMP/word-repair-software-3.0.exe
Resource
win10v2004-20240910-en
General
-
Target
$TEMP/word-repair-software-3.0.exe
-
Size
2.5MB
-
MD5
4507e7f8735f635c3a8d7e68065c84f5
-
SHA1
8ee35074ed849951ab20adaf17fe94b547052b84
-
SHA256
ff56cd8c718acaecb7f1430126731818be51d66ab0c0e5543dd22770510b6f9c
-
SHA512
8c3105fd3ac57281bcbdae89421cc37e7aa3e145c5ece4ad7a89a9702e721bb8780c7829b182b4c42d86ea382bda1d014d43fc0fe73a89a60f25e2e9642ec394
-
SSDEEP
49152:L2XOSt1QL6DTmm/Z2I99PbSHnfLsfUgZ4m2dxfv4a+lWY+hCqr17Sjj0blHnSq:CxML6nZgGijsxZ4m2dxfv4a2WOS17uQ9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4288 word-repair-software-3.0.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language word-repair-software-3.0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language word-repair-software-3.0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3116 wrote to memory of 4288 3116 word-repair-software-3.0.exe 83 PID 3116 wrote to memory of 4288 3116 word-repair-software-3.0.exe 83 PID 3116 wrote to memory of 4288 3116 word-repair-software-3.0.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\word-repair-software-3.0.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\word-repair-software-3.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\is-F7RK0.tmp\word-repair-software-3.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-F7RK0.tmp\word-repair-software-3.0.tmp" /SL5="$5026E,2363002,54272,C:\Users\Admin\AppData\Local\Temp\$TEMP\word-repair-software-3.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD50fed0ac6b23dd0774476bf124ffaf9d4
SHA17b67a702d1ed31597fcb45b79e894f1303cb7b98
SHA256fc516517a9796d1c45dd8c883feec1aa6952d7cf713eaec9ae6069265de35964
SHA5122728923e238b5a7d3d7eb25855c1aa9c54e1db5bad3039cf4709371a25cc857e63611b8beba78c39965aedc852e4234b70b52d4e793d797ec57f979e9ab61a98