Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
09-07-2024 15:05
General
-
Target
$PLUGINSDIR/license_GDS.rtf
-
Size
29KB
-
MD5
572c844641b7c89bd8e5c4b09db51eec
-
SHA1
7db62a97beda7fc9082e324ac0bcef1fb6ddd8d3
-
SHA256
9e4ada9fb4257e97feb8582c94f3a90c9a789d90c8cc45191eeffe7e90cf51c3
-
SHA512
74209b504f03749121dc76e95057981d5130f4fed5b718f64e95634ad0f32ebc611a61e7761d338eb470dddaf85c70897eb9132f57b181afe5139f248bf69547
-
SSDEEP
768:sWpF1sXIAbjZ+SjluFI7csb5ftkhL5UMHX6YZr/+nvwMwA2/Rk/CusmUHo:7L+fwR/q/lx
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_GDS.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5ecaa103bc193a677a8ecbb0948865fae
SHA1ca98fb47f931b732debeb0eb26768957f42f97c4
SHA256d4af47a47ecfa0cd02751a9eb2fa6a80a1fe14a87df9c5c45a49714c8ac880cb
SHA512fde024aaed060405063146b5ccdeaecf063d637a6315b6331151a4879c28da8ab1c972a9d9f4aabba174ed8f9138014369b6b196dc428e53c83a7137e132a859
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB