270248e6a629a7d47374cf2c8a172000ca6790c7ab7e90eac0fdbac902122958

Analysis

max time kernel
123s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc_main_14.docx
Size

107KB
MD5

22a592907fe0e0b8cf0e76be20c09e27
SHA1

71ba75475b1b33abcb2f55dcd06f232481c2cb90
SHA256

73e3a33304c9d736113ee81e5e205a99bba264de4842c6aa87a03a075ef01149
SHA512

6cd1274dada327ade67c4242cf46107b8b619e163261f2b93900cb0d1a54f06822c22f49287a8c71ff1bb799f1984ccecda3627fd531df242c5174302a252b22
SSDEEP

3072:WeBQAhNHh83WrtH8ynSlP2UUQk+CmLSZd8:PLvB83+cySlVYmL48

Score

7^/10

discovery

Malware Config

Signatures

Abuses OpenXML format to download file from external location

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2060	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2060	WINWORD.EXE
2060	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 980	2060	WINWORD.EXE	31
PID 2060 wrote to memory of 980	2060	WINWORD.EXE	31
PID 2060 wrote to memory of 980	2060	WINWORD.EXE	31
PID 2060 wrote to memory of 980	2060	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\doc_main_14.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{9C93A3E0-CC75-4171-B864-263CF63CA92B}.FSD

Filesize
128KB

MD5
48e0965ccf2d6d0a4561aa5a43f77055

SHA1
4f63f93b3b13f268e4b7430ffc3331f852cfb745

SHA256
1d80855788569383e90a22f4e7738aaaacc5a0e4c41e42f2087148896ce8a3be

SHA512
d2195f11f24a4466c97fa41892d4a7025eeaa27a1cbc8d15b47a35ab6f1af9d16879cf183f217a7e976005070baf78dc54524ab578f4dfa59bee59160f8c37dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Filesize
128KB

MD5
266fd038d4d0df395103f24d728f41e5

SHA1
98861122073b597d57117feb6b42bffa740bc6ff

SHA256
c67c7ef7cb888d431103c76822035eb1b28677bd1435f7211f8911de7c77ec5e

SHA512
a8250e2c339b75c4ae040baaee2223a1af83282c6be6248e6c6b9fcebec2bd5f18b40f2620754f03b14fb992f7ebf6bb5c1a0807534d5490085d5a46c1213f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{B3DB3B85-68D1-4049-A207-9D2913B07846}.FSD

Filesize
128KB

MD5
773b0a16f82fa0f78bf1e7117472f409

SHA1
ff32c33a5667258a86810ee2f0b9058f24c060c3

SHA256
89d9739097893e7250c70909d1e874a3944f64db7222ba5ea9a1c56a69852ccf

SHA512
88a1fb31b7b3690a00b9dd44c510dbff3a390de8138ac3840cf4b7a832517296611ac86f52da5c4f64ad05a8d7d023be4ed6eeed30d85fb242d951754966821a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{243B9C38-F7F5-415B-84B9-7CC44731B27B}

Filesize
128KB

MD5
efb2c02b1966c39586b4534ebad2e9f7

SHA1
d88d3412b884c848171318d74a48064e6fa268af

SHA256
e03e7f3ad7a73a50114bdf0f69b90c5b8d8870d6e63c9c0baa499924ab378bc5

SHA512
65892a3c531f07aaa544d2f0412cfbf5291b77a46a280a3c184b0dbf037f2e62da05772e06651f3fd1b08da227627da0c390c3d1d5023f19e70273bdadb97a78

Download Submit
memory/2060-0-0x000000002F4A1000-0x000000002F4A2000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2060-2-0x00000000719FD000-0x0000000071A08000-memory.dmp

Filesize
44KB

Download
memory/2060-62-0x00000000719FD000-0x0000000071A08000-memory.dmp

Filesize
44KB

Download