Analysis
-
max time kernel
37s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
14-07-2023 17:26
General
-
Target
a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f.docx
-
Size
117KB
-
MD5
d227874863036b8e73a3894a19bd25a0
-
SHA1
2400b169ee2c38ac146c67408debc9b4fa4fca5f
-
SHA256
a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f
-
SHA512
5304a8f4fce0718df717e67b0c91b3aef670f8fa226ee49dc23b72bb677301d310016626433ee8336f393f2afc92609f6c69c99862055c71316bef3f762714ed
-
SSDEEP
3072:l7+cULFyt0l7P8trDG5CL1WvRC5pugMExFAiWRXlV:lPrtWuK5C8vE5puiFAimlV
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f.docx"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-54-0x000000002F580000-0x000000002F6DD000-memory.dmpFilesize
1.4MB
-
memory/2292-55-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2292-56-0x000000007131D000-0x0000000071328000-memory.dmpFilesize
44KB
-
memory/2292-68-0x000000002F580000-0x000000002F6DD000-memory.dmpFilesize
1.4MB
-
memory/2292-69-0x000000007131D000-0x0000000071328000-memory.dmpFilesize
44KB