Analysis
-
max time kernel
126s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 21:47
Static task
static1
Behavioral task
behavioral1
Sample
9483ce32d2782940a10d3adde0672765930fe7ecfac3f8e4cad50b870316b758.docx
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9483ce32d2782940a10d3adde0672765930fe7ecfac3f8e4cad50b870316b758.docx
Resource
win10v2004-20241007-en
General
-
Target
9483ce32d2782940a10d3adde0672765930fe7ecfac3f8e4cad50b870316b758.docx
-
Size
12KB
-
MD5
7d206684fbf955cf16abb54f17c95d7b
-
SHA1
0aceac53c75bcc176ff64621118e9612f3b3b33b
-
SHA256
9483ce32d2782940a10d3adde0672765930fe7ecfac3f8e4cad50b870316b758
-
SHA512
8db6503d82006a9a2d2151d753dfdd4ec52d116b284bd3f5b866d9c7d9b52540d514f93a00a74ed21b2b98315d3db5a75927c4f62ab8487d4c0539df7c1c0d97
-
SSDEEP
384:C6sZXSIh7hvXGMH111/em5bi4GmZa3Ktz+xZwFLOcqK:CXWEeaXJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\mhtml:https:\rb6z69deadx2ocgwl1s11bd3lurlfc90y.oastify.com\word.html!x-usc:https:\rb6z69deadx2ocgwl1s11bd3lurlfc90y.oastify.com\word.html WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2292 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2292 WINWORD.EXE 2292 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9483ce32d2782940a10d3adde0672765930fe7ecfac3f8e4cad50b870316b758.docx"1⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{BC98D752-E36D-4D2A-8187-56F867CA5E7D}.FSD
Filesize128KB
MD52ebc093d0179aed62e85053bcc78a3da
SHA1f9d3f3ed2057590b8c9b6288c451808d60db2462
SHA256e5c620facc8d72a42a061e912a5263c5ad0cc3a01d0a31459740ac16b4629a9a
SHA512d0116de22eb6f80d8010c0bdfe528db5f0f21008977ed6196f3ffbd382c660b8089d19b67f609848b1692ad52649a8e93d18ab2b388235dbdcc6de772f72be36
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Filesize128KB
MD578cb98ace1b8b62de1ab379ee3302350
SHA13bf93b9c410ac1e370b560e98260228bf501c425
SHA256a16b0450082102c508cc5c38d42876311853be66f49e3d00768a7f72b535cdcf
SHA512410beba1c89642b9c6bbfbddb0099ab1aa0c10d1aa6140b077b68a2d1a66fc87cf84d24773c81a2775b93277ad46af12eb0ccfd4f4a497b48c60c5d21c994fbc
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{F191A0AC-F365-4F96-8BD5-B1A914E7A8B4}.FSD
Filesize128KB
MD59454591dee3172976d1174b71d3a6052
SHA1ea34038797f3d6e675b07636f071b910f7ca0f20
SHA256cb7aa54e152de018f5d193b847fee0289a740fc0d6c5f3cae01e8b44ad368599
SHA512a99c31a425f10c525ad9ac265bf249103ac61e40675b9ef0b2f65b900f8279c67c7b61559309ab8eb74463b577be230b0aa77248297fc6726cb4ef6ca04a1f36
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
128KB
MD5c758e365d9630b8a51cb65bd059011b9
SHA18175b41013f9206823384e08a0bd80e20202e9c8
SHA2566e6e8737089058c969ad74f1473d12ec9b39c6bc76d71809a37a29d4fdf0d34b
SHA512807b5955f92da5f05696db3e738258f8ef435c3b4d559b1f1ea89179f689c4433163363b0ee1192bad6ba35d8489bd6eaf983c2e740c4e6eb56edf5278e20585