Resubmissions
05-10-2024 19:24
241005-x4rgzsvelc 1005-10-2024 19:24
241005-x4mh2azenj 405-10-2024 19:20
241005-x2klnazdrq 1005-10-2024 19:18
241005-xz4xhsvdkh 4Analysis
-
max time kernel
2s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 19:24
Static task
static1
Behavioral task
behavioral1
Sample
Ratio-Linking-Ratio-to-Formula-New-GCSE-Questions(Bt).docx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ratio-Linking-Ratio-to-Formula-New-GCSE-Questions(Bt).docx
Resource
win10v2004-20240802-en
General
-
Target
Ratio-Linking-Ratio-to-Formula-New-GCSE-Questions(Bt).docx
-
Size
13KB
-
MD5
a61f3089b7e993c2cfb425125cb4bcae
-
SHA1
05c8401b0c572ab98423770ccf39a394815a3a99
-
SHA256
815dfa5f4d592f76301a5f0f8ea7ecc53db9057e91b61292aee006337a17386e
-
SHA512
22ee0a814016a50dd32db06989544d5809652271b85b21729db976930ca9f51c9c2b22ff7948c27cd1d2a31799e0b2c4cd5c8a9ce94ab1dd20f4e99754873e31
-
SSDEEP
384:aN4F06wSpn0i13LU9FiKkDb3E+cLwoetwx02:kLqv13o3iVv3E+cLwoetc
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1716 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1716 WINWORD.EXE 1716 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1716 wrote to memory of 2936 1716 WINWORD.EXE splwow64.exe PID 1716 wrote to memory of 2936 1716 WINWORD.EXE splwow64.exe PID 1716 wrote to memory of 2936 1716 WINWORD.EXE splwow64.exe PID 1716 wrote to memory of 2936 1716 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Ratio-Linking-Ratio-to-Formula-New-GCSE-Questions(Bt).docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2936