Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
bc9774804cbf9c9b994b0379c78ec2b3.rtf
Resource
win7-20230712-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc9774804cbf9c9b994b0379c78ec2b3.rtf
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
bc9774804cbf9c9b994b0379c78ec2b3.rtf
-
Size
53KB
-
MD5
bc9774804cbf9c9b994b0379c78ec2b3
-
SHA1
1c05afde402fed521257475a53f7fc782cddbbe1
-
SHA256
041afb2745c2fc431a3617df448eb7ef5ebbe6ea8f6392b8c11928205f9f40fc
-
SHA512
5ee7fd1078f9dd7e95a373944ffe3c59823d49ce46fe8419dfb008e089b9763fa76837e04d77ef7d8ed0749fff807a973fc4aeeae53f12275e4d691de4e94002
-
SSDEEP
768:ZeX1/30Xj3TOGT9Bz2E262Duj2Ajn8l/NLoJ0o:ZeXeXjnDJbEHo
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1084 WINWORD.EXE 1084 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE 1084 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bc9774804cbf9c9b994b0379c78ec2b3.rtf" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1084