ed60103a8a1837ed4691670a5307539ec832cf3ad076d6afe3bbf06c84ad4511

Analysis

max time kernel
0s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15eb68a65e9ac7367a6e6bdf51eee30a.rtf
Size

229KB
MD5

15eb68a65e9ac7367a6e6bdf51eee30a
SHA1

d988bf603a28bcb2c031f00101ee83509c0bce1b
SHA256

ed60103a8a1837ed4691670a5307539ec832cf3ad076d6afe3bbf06c84ad4511
SHA512

e86382cc89ac3d79551b2721dc44cfcb987d73151bb539a2436123f5863c1f57c902ac348be494322ff25cfb8628354df9e8f7cdac71ef605ca8a70172c5924b
SSDEEP

1536:iqW7qA4b645VTDuhrNnlwrnEYo9V2A0RowKxvVCpBdzFz76mAg5eeVhMDw5wfLT:iqW7qA4b645wvrgBdzFtr5RDAw5wfv

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3308	3576	FLTLDR.EXE	14

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3576	WINWORD.EXE
3576	WINWORD.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3576	WINWORD.EXE
3576	WINWORD.EXE
3576	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\15eb68a65e9ac7367a6e6bdf51eee30a.rtf" /o ""
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3576
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT
  2⤵
  - Process spawned unexpected child process
  PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/3308-30-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3308-33-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3308-32-0x00007FF8D4330000-0x00007FF8D4340000-memory.dmp

Filesize
64KB

Download
memory/3308-31-0x00007FF9119D0000-0x00007FF911C99000-memory.dmp

Filesize
2.8MB

Download
memory/3576-11-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-16-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-22-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-21-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-19-0x00007FF8D21F0000-0x00007FF8D2200000-memory.dmp

Filesize
64KB

Download
memory/3576-17-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-15-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-14-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-13-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-7-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-20-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-12-0x00007FF8D21F0000-0x00007FF8D2200000-memory.dmp

Filesize
64KB

Download
memory/3576-18-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-23-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-8-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-9-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-6-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-5-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-4-0x00007FF8D4330000-0x00007FF8D4340000-memory.dmp

Filesize
64KB

Download
memory/3576-3-0x00007FF8D4330000-0x00007FF8D4340000-memory.dmp

Filesize
64KB

Download
memory/3576-2-0x00007FF8D4330000-0x00007FF8D4340000-memory.dmp

Filesize
64KB

Download
memory/3576-1-0x00007FF8D4330000-0x00007FF8D4340000-memory.dmp

Filesize
64KB

Download
memory/3576-0-0x00007FF8D4330000-0x00007FF8D4340000-memory.dmp

Filesize
64KB

Download
memory/3576-10-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download
memory/3576-52-0x00007FF9142B0000-0x00007FF9144A5000-memory.dmp

Filesize
2.0MB

Download