Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 15:08
Static task
static1
Behavioral task
behavioral1
Sample
basta/basta.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
basta/basta.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
basta/blank.docx
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
basta/blank.docx
Resource
win10v2004-20241007-en
General
-
Target
basta/blank.docx
-
Size
97KB
-
MD5
faef191f63aa34eaf62b309e1fa6797b
-
SHA1
f694595c850267b72ae7d78deb087badcaba1e9c
-
SHA256
23628968944a6db98842aa2b69d931edd4dd889ff51d345373624af62f71f5b7
-
SHA512
0bc5de66bdf619cd3a56916c0918d12ac1412e83b18d44db55b7593e4a29c9ff96f84b48b945b80ff50cfebd812a543be70e3298205bd46b9c6c8f8b1e01b617
-
SSDEEP
3:v:v
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1016 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1016 WINWORD.EXE 1016 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\basta\blank.docx"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1016