Analysis
-
max time kernel
108s -
max time network
42s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
03-04-2020 02:47
General
-
Target
3f6bcebf86443d834e6e8cac82c0bc2df9ef4321b0ff9d8fe1947a9c96916947.doc
-
Size
437KB
-
MD5
c2dbe8de78ec536def222cd8de84686d
-
SHA1
ed72419e4f56022a1cc764e37957fb9a91ffbf77
-
SHA256
3f6bcebf86443d834e6e8cac82c0bc2df9ef4321b0ff9d8fe1947a9c96916947
-
SHA512
2b088f58a03af7e0b07a76ac728dbad5b91ad41990e6033fbb42b74eb1506e80dfb34a7d44dcd3ee0c638a60d208a4b7340c2d205e23b98ac94a5076ed33fb74
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3f6bcebf86443d834e6e8cac82c0bc2df9ef4321b0ff9d8fe1947a9c96916947.doc"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1840-0-0x0000000007140000-0x0000000007144000-memory.dmpFilesize
16KB
-
memory/1840-1-0x0000000006870000-0x00000000068E0000-memory.dmpFilesize
448KB
-
memory/1840-2-0x0000000007140000-0x0000000007144000-memory.dmpFilesize
16KB
-
memory/1840-3-0x0000000000333000-0x0000000000337000-memory.dmpFilesize
16KB
-
memory/1840-4-0x0000000000333000-0x0000000000337000-memory.dmpFilesize
16KB
-
memory/1840-7-0x0000000009810000-0x0000000009814000-memory.dmpFilesize
16KB
-
memory/1840-8-0x0000000009810000-0x0000000009814000-memory.dmpFilesize
16KB
-
memory/1840-9-0x0000000000333000-0x0000000000337000-memory.dmpFilesize
16KB
-
memory/1840-15-0x0000000007250000-0x0000000007254000-memory.dmpFilesize
16KB
-
memory/1840-16-0x00000000082C0000-0x00000000082C4000-memory.dmpFilesize
16KB
-
memory/1840-17-0x0000000005750000-0x0000000005754000-memory.dmpFilesize
16KB