Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
12/07/2024, 10:53
General
-
Target
$PLUGINSDIR/license_pw.rtf
-
Size
27KB
-
MD5
1397d6205e393a50b8ed0b98bff4310f
-
SHA1
7eee5db6caea6603b3c21c65d6b3600d806916ba
-
SHA256
d74e676b28dcae57df5027f4167b107a4597a9ab99754d5844ae639b88e5ec85
-
SHA512
5bc18c65300ac2e0174f5a90002e9a9915c54efadc64d6d078fd4875412b5042e2e61d9a9a83cfedee596bce41eb5210b65f699a764fb8ae319a3031b99c8e95
-
SSDEEP
768:ExgL1TtcaEN0L25ovNmkRi6dHnlFarvevr2k:dsN35ov4kRi6dHlFarvevH
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_pw.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD59faa87a8f212753af43d2f5f560449b7
SHA185e51a0d0642bc7ff57c74dcd670d7307386c6d9
SHA256b9b3778378a6266f2be2e45c61d41555ed9d9316f061fdbf68c40da4dbef8f42
SHA5120d279d67e9eb3a4fad122c262f98800be208295249bc4c1d87e409a6377468aa3deba3dbb985187dd7e709bc1fb0bf3063038a884bacc182a25270cbc3a0a873
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB