Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
09-07-2024 03:45
General
-
Target
$PLUGINSDIR/facemoods_terms.rtf
-
Size
80KB
-
MD5
021f978d062bdf04b58327f3b67c8aeb
-
SHA1
704ddc83f32a5ce6c95a1ce9af74f8f7b60c2a95
-
SHA256
7faf940cf5a2abc900639ade3262db9a9b0f623047a67e6b165c73aa33b90d35
-
SHA512
f69264f3aff95d0fde5a582fa75a8d8bd74eeac255e6e7beb7723ae5260a5e1fc05e25e446a786b0003b40f3e75610ccf82013e6a86c73dd3c9a32ce20d7b97b
-
SSDEEP
768:l813p3VdAkF8bmrF5oa5Fscm0GEsGugGcQ/yK74fsWc24hAZqC3:l8TN8bqbGZytsWcwj3
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\facemoods_terms.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD58f0f51b54b8d2de2d9dce82383f00310
SHA16b5dd4083bc0dd1d772cdfc43c10c65837de08e9
SHA2566c686e9438bcd53f10a66f690605e8707e34e964861a2f216aae9b845367bff7
SHA51270df0c59df524dab1938a421903e9a89ed618e19d825d55098dfa18dc473e12106a4e82174ca9f290d317a875ddb1c52b4f255a618103a08cd945c298c6b43fc
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB