Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2023 20:04
Static task
static1
Behavioral task
behavioral1
Sample
idbk6758400000000000#########534400000000000#59t00000.rtf
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
idbk6758400000000000#########534400000000000#59t00000.rtf
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
idbk6758400000000000#########534400000000000#59t00000.rtf
-
Size
32KB
-
MD5
7eb05bcc9d2d6f3edaa773d3d602b1a1
-
SHA1
7a18c0ae8230636baa80cf57a142c15268cd60bf
-
SHA256
cbd47a384b39f793539e45c67dccebd52da0a0db7463ac6280d30889f1c1a823
-
SHA512
00f1c76d5c33f5423a83494cb13bc67c91f408711a7d0a30710d576e2f2429943682de198f720b8da3d54d1a5407ed270f12f79893da36e985d79edc49c0c038
-
SSDEEP
768:MriCXz3A4/j6USc2ci0qSZ2UdbRBZjgVnLQfjVNGxo42vY6:M7jlbwcBjPdVjgBx9il
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3196 WINWORD.EXE 3196 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3196 WINWORD.EXE 3196 WINWORD.EXE 3196 WINWORD.EXE 3196 WINWORD.EXE 3196 WINWORD.EXE 3196 WINWORD.EXE 3196 WINWORD.EXE 3196 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\idbk6758400000000000#########534400000000000#59t00000.rtf" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3196