Analysis
-
max time kernel
0s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09-01-2024 18:20
General
-
Target
eadb63568de96f6f86bffc03b17ac4a2.rtf
-
Size
112KB
-
MD5
eadb63568de96f6f86bffc03b17ac4a2
-
SHA1
c8c37b217c68e79045627f7a490cbc2dc6550eb8
-
SHA256
a5de6df9430d1b9e900b43facc523353d98c46343fc8a7817f3d83297bc10d06
-
SHA512
b3e032b45526af1b158ff34400afa696d04bd1beed90f888ecef1ca7763df170be1c04f0feccf90bffd34560902d2749e8ba0def48fa32263d92ad593c920b0d
-
SSDEEP
1536:BQ5FZmoQ88R0ItukN+6wq1iiw/uoZ2IDE62mTimURiY2wv5u+7DtQjTa/Jh/GfNk:BYa7R0IQkNzoiw/H8grJPw
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eadb63568de96f6f86bffc03b17ac4a2.rtf" /o ""1⤵
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB