f765f3f4cac62396a00b1a1b5e39f00213d51bd3e816213c7a19784e98630577 | Triage

Analysis

max time kernel
70s
max time network
22s
platform
windows7_x64
resource
win7v200722
submitted
17-10-2020 13:34

Sharing

Report Analysis Logs

General

Target

5e84efe4d51ed6e3de4aca32ec599edaf9fd1a2ff1a45dae5d471a53fd121e3e.doc
Size

1.1MB
MD5

c4dc25fdbdc0b722de6cb190e08757ce
SHA1

d52e95b887badf0081d66965913555a0b59f00e9
SHA256

5e84efe4d51ed6e3de4aca32ec599edaf9fd1a2ff1a45dae5d471a53fd121e3e
SHA512

7fe15ed619e2957ba3563c05c807e673f9927e1a4324c95114aca04dd30e1fc1dfb18a55a3840278b7ef1fe5346b242e6875c2228344302c51c3398c211c9a48

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1432 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1432 WINWORD.EXE
1432 WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5e84efe4d51ed6e3de4aca32ec599edaf9fd1a2ff1a45dae5d471a53fd121e3e.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1432

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...