270248e6a629a7d47374cf2c8a172000ca6790c7ab7e90eac0fdbac902122958

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/12/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc_main_13.docx
Size

111KB
MD5

9084e4d8ac94932754f159bc8cd1d6d9
SHA1

f79cb584125657f838d93eba298a0a9f03c13788
SHA256

a0b090d191661c0f390d924b084eefa2688ea185fd8eeade4f8718fc6d7dff2b
SHA512

d0c593e2f13321cd2c10bb3d7f4a22dea0dd9c4165cead90ac4f292e34e0d56ae95f040ecf40630884a748522485c6374852238e240a0cb7fc3788690be07d8a
SSDEEP

3072:WeBQAhNHh83WrtH8ynSlP2UUQk+CmLSZHU:PLvB83+cySlVYmL9

Score

7^/10

discovery

Malware Config

Signatures

Abuses OpenXML format to download file from external location

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2788	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2788	WINWORD.EXE
2788	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 1736	2788	WINWORD.EXE	33
PID 2788 wrote to memory of 1736	2788	WINWORD.EXE	33
PID 2788 wrote to memory of 1736	2788	WINWORD.EXE	33
PID 2788 wrote to memory of 1736	2788	WINWORD.EXE	33

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc_main_13.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

Filesize
128KB

MD5
daf1b14b87eec49efe58e6b928fbce08

SHA1
1b625a3e5a110de9e59594e6fc4a20394c609581

SHA256
bf1a3557993091e1cbe9ae6186afbf77e439624e5d05c35e1602612056d314c0

SHA512
8ce88fffb4ae60e17e82a93e7c758f453fb4bc1ee45682379d2af3f90485ba14e5e678fbd0213ee318be20eed50ca10b6215907c39d1a444fda06f4730f954a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{AD3A1112-CDA8-4BE8-BE94-D1C3451CD418}.FSD

Filesize
128KB

MD5
2824febe7ef31436a2b2def40b6be838

SHA1
84eae773cb1f31c913f5a8a01f250d2cc444b38d

SHA256
02d71ac18195a82486893afdcbeda26d24e055c25cfd246cecdba1084da17f9a

SHA512
df73dc1adbefebf9783dab83df5cf3d47fc11fc6e0f29cd86af9f8b37cb62ccd2dd2eb2b6d24f063cc8d28b7493ebfb24bc9f82d1588743f6c168aee88c957cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Filesize
128KB

MD5
c99708eeaa15fffcdc418447121fb34c

SHA1
36d33c763f5898a388aeda0aba013c473de1e59a

SHA256
f6f787b15f37d7a7e8b49f72cb0ffcd52a0213bad11352ad31b176058e5c176b

SHA512
c5036d2c65df0cf8ec826187e18f757d68a88b14bfb5b6836f8dcaf4c54594cc8e4e0ee38c4701305152c9dbe5e918b81d1f81f69cff94fe281f1198ec473ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{4CB653DE-0C73-4F2D-BD3B-7B41193B19B3}.FSD

Filesize
128KB

MD5
061a5a1545535af6acc84d9ecfd7b7e0

SHA1
7b6e615af3e3ddb6d92499a3bc0af74bd886df6b

SHA256
ab8dc3d58c1fd3692eb3bdd07a04ca7024f62e3f99a33f8bb396ed406bb30335

SHA512
f4d9f3834607a6ef66d3ac76910f08ea7f62cd930e1e76329d8c98605914308d322c8dc5377d2288a87456bf30b5d6ae29c3e47c20b3a26da6990344d2df387d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B841AACF-EA62-400E-939B-652B2B78FF6D}

Filesize
128KB

MD5
8cca590145fd985d8e916989106b3094

SHA1
7758879e0d4856a1c813d73a7a9f276e166c0949

SHA256
8e7675ffbfe582cd3e1fb7fa1258c28adb5dd9db31479e1aa739636984d848ab

SHA512
7ab40e5b9cffc72ef841c2441feb7c590aff65de3f28acd8a0324b46332eee731e19a4d060411162fa6a084443ecab28025f82d726d2bcd5eca10fd320e91aa7

Download Submit
memory/2788-0-0x000000002F081000-0x000000002F082000-memory.dmp

Filesize
4KB

Download
memory/2788-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2788-2-0x000000007105D000-0x0000000071068000-memory.dmp

Filesize
44KB

Download
memory/2788-66-0x000000007105D000-0x0000000071068000-memory.dmp

Filesize
44KB

Download