Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
09-07-2024 09:06
General
-
Target
$PLUGINSDIR/AnimalShopping_license.rtf
-
Size
102KB
-
MD5
b9f0a9106d9c55d17ec154ae8c736688
-
SHA1
529b0a0821e8acb5ab0d95d8fa10b24110264422
-
SHA256
3e76b19f84b09bdf29a841978d19290ccaa6aeea46676eb89e9a02f977704332
-
SHA512
5dec17fdf3e9685b370707f9b65848414ad3db09fd30a56096b25af5872ff7276d03d2a854f0573ce98963627795b1aee1ee9fe738cc3a2320d9c572cba863c8
-
SSDEEP
3072:rCnlb8SacXMYUGL/IpJZ9zzNA5Kv1kCn6:O+g/IpJDzzNA5Kv1kC6
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimalShopping_license.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5410cfd283705bcaed38a8fd3968ab7d0
SHA1428020b0e16ba3d93e16b36eb10387e6c43b31f4
SHA256add915d1817ed4571cfb042e99c4e2a40ccefbc6e3f967d224462531ce3e6c8a
SHA51232098c6c7a5905c31d4a4de22563d17ccb427dbe11d9d691ee3cc0a419e0f68b636b58a58955617656dd26fb3c1bccb338a327d658ca72f95aecf936d5e67fd2
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB