Analysis
-
max time kernel
96s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
word.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
word.exe
Resource
win10v2004-20240802-en
General
-
Target
word.exe
-
Size
1.4MB
-
MD5
836e5547f08551394488c7d813b0527c
-
SHA1
98f7f9c2f4b495179a736e55ad8e22b88f2e3089
-
SHA256
43d13c2513f89bf54b976d8ff62fdb782eb303062b0db47343751e2047f4422f
-
SHA512
bab510e7986f0c3472f066d77c7b0d7ccb3defdb69b101b4af276733b9d760bc48204b7d64aada3d319969e99ddb856d8882751002f83bbb63498e5b242de61d
-
SSDEEP
24576:AfmMv6Ckr7Mny5QneMaxt0ArC04NNtKutuqxskVPy22amBkyYJFVBEBizCP4E:A3v+7/5QeMaxt0At4NNNj20pmBkyYbHm
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1540 set thread context of 4116 1540 word.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language word.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe 4116 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1540 word.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1540 wrote to memory of 4116 1540 word.exe 82 PID 1540 wrote to memory of 4116 1540 word.exe 82 PID 1540 wrote to memory of 4116 1540 word.exe 82 PID 1540 wrote to memory of 4116 1540 word.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\word.exe"C:\Users\Admin\AppData\Local\Temp\word.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\word.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116
-