270248e6a629a7d47374cf2c8a172000ca6790c7ab7e90eac0fdbac902122958

Analysis

max time kernel
123s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc_main_10.docx
Size

112KB
MD5

7b55e7c7dcaecc70fcc4264559ea9c09
SHA1

f55723625379fe506ac98da30590f27f932e5b15
SHA256

1703116eca314f5776d7a78d5f5dc9d4263f22a688d162593ae237c1ba790fb3
SHA512

1100357cc67ebea9cc6ccc6259b52b3073509530be3c23d2d11e68d0988f240c721c870dafd3c2bf25537b68ec6bcfb5822e214a90492bb3435515b42b9d721e
SSDEEP

3072:WeBQAhNHh83WrtH8ynSlP2UUQk+CmLSZFQ3:PLvB83+cySlVYmLP3

Score

7^/10

discovery

Malware Config

Signatures

Abuses OpenXML format to download file from external location

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1792	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1792	WINWORD.EXE
1792	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3004	1792	WINWORD.EXE	32
PID 1792 wrote to memory of 3004	1792	WINWORD.EXE	32
PID 1792 wrote to memory of 3004	1792	WINWORD.EXE	32
PID 1792 wrote to memory of 3004	1792	WINWORD.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc_main_10.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{740D6A29-EA4D-4AAF-AB9A-68993F294005}.FSD

Filesize
128KB

MD5
9f620d31f0872856a587f7fe860c23fb

SHA1
5a52f3d2513e643172c540017cee1ec6281cdb70

SHA256
52c8063632a60e5f968ba1977f67dc30332337960bf9c0fa0dde7bd7e1751e67

SHA512
4a85deb9636397885592335f050bdb2aad97c7c156ed3fe294ce554b0876cb3a91d0d138251b2abe55703313747a18803c74b910a438ae70cceaa81dde1517e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{18EB2D97-D472-4B87-AC18-1354CCC1F6F4}

Filesize
128KB

MD5
9e3bc0b355b728527132f132998fa675

SHA1
4be56656e346b8d082231a725b3d21494d32db09

SHA256
2e7051eda00ae9cfb39795ea302813a521a75bb9bd5cfba819a66312413b8e50

SHA512
95a297f50e3ebd6abc5f213308002d390672481d2eabebf36a8bd0185d6cdba58930997d3be8dcf8c5e3793d4ce603d42485128776eab9fabd5260b8454a5e09

Download Submit
memory/1792-0-0x000000002F151000-0x000000002F152000-memory.dmp

Filesize
4KB

Download
memory/1792-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1792-2-0x0000000070FCD000-0x0000000070FD8000-memory.dmp

Filesize
44KB

Download
memory/1792-62-0x0000000070FCD000-0x0000000070FD8000-memory.dmp

Filesize
44KB

Download