Task
task1
Sample
Docs_bbea066160cdad85d59d474078ba235f.com.doc
Resource
win7v191014
0 signatures
General
- Target Docs_bbea066160cdad85d59d474078ba235f.com
- Sample191113-dq69yzntls
- SHA256 4060463d50360718740df83648d11567cf0a9c6364ec97d7e16204c4d171a0e5
Score
N/A
Malware Config
Signatures
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1092 WINWORD.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1092 WINWORD.EXE -
description ioc pid Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm 1092 WINWORD.EXE File created C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm 1092 WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\Docs_bbea066160cdad85d59d474078ba235f.com.doc 1092 WINWORD.EXE File created C:\Users\Admin\AppData\Local\Temp\~$cs_bbea066160cdad85d59d474078ba235f.com.doc 1092 WINWORD.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1092 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_bbea066160cdad85d59d474078ba235f.com.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Drops Office document
- Suspicious behavior: GetForegroundWindowSpam
PID:1092