Task
task1
Sample
Docs_caa116070d1f2f48f3a9964e695226cc.html.docx
Resource
win7
0 signatures
Task
task2
Sample
Docs_caa116070d1f2f48f3a9964e695226cc.html.docx
Resource
win10
0 signatures
General
-
Target
Docs_caa116070d1f2f48f3a9964e695226cc.html
-
Sample
190918-patyg4d1l6
-
SHA256
9fe890f4a1393ef301e24b02ab3c173f230ad7a982808ce6daf130c861422208
Score
N/A
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener
-
Suspicious use of SetWindowsHookEx
-
at description ioc Process 4711 File created C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm WINWORD.EXE 5663 File created C:\Users\Admin\AppData\Local\Temp\~$cs_caa116070d1f2f48f3a9964e695226cc.html.docx WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_caa116070d1f2f48f3a9964e695226cc.html.docx"1⤵
- Drops Office document
PID:1228
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:304