Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
09-07-2024 03:45
General
-
Target
$PLUGINSDIR/EZT_EULA.rtf
-
Size
62KB
-
MD5
3584a8d7f66ffad1b321d682bdd71c12
-
SHA1
88e7aed78aa695f34200bab80d2686770f8a8d0d
-
SHA256
482a0dc0ecd1099bc772e3021907635ad53164897dcd3c97d86eda4d00a7a719
-
SHA512
48a68cc55c006d4eef7cc4c334ccf3caaa4af2aa966157ba3b08eaaabe4f3093ef05745d5e80e342a37a383be0112bbb28f9031977d9e495ea9e09591dd935b4
-
SSDEEP
384:AGtwgDrN79ozVzEFHQezWf4RnDQg4so6iETJTPwa54vg3Rvjlyb3OEi6rGsNAYAG:AG7QezWwnDQgxPiKvjlc7hAZqCM
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EZT_EULA.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5e2d726324056be88af14fc69a6cce74f
SHA1f34fd2c96fa98d9c67461e110e7277eac29daf03
SHA256a5629acbde59b45a46a7d4b35a77a17efbb7b22545ef19324e4a435a677538f9
SHA51243c3d936889a67747ea9a88db6dcbfd9d3eb6578689fa3bb13489d0d458a8960fbb969d7a0eca6dffe7b60e293d5e75139365af17ef6a32b43b45b72d0c7a3da
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB