Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13/07/2024, 22:15
General
-
Target
$PLUGINSDIR/license_csu.rtf
-
Size
5KB
-
MD5
e86b3ccc6b5f1745e63286184f3eedf7
-
SHA1
bab01972df4d5c2e0b5e06452e0d57748e898554
-
SHA256
6e620648f31c8b98003c1a72b017471caf6b059bd5aacf745fd7b09e4861ca33
-
SHA512
f3b07bd0c1cbe66da797669e1d5e77f6c3047d5bd92c0080e662703501d68c6bc9787e38e8137bc4efc0c0a2824a0e41188b641b94c2eb0d06b73d82b9950608
-
SSDEEP
48:2c6yLaMdzgBncBQtAzo+1d9SKfV+6ZzB0dNlFztOHi26H2aOfvWYWDZjJ0oA1RSJ:FaUB2/Izfv3F1RSFFSksfg6RvoppfV
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_csu.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5840f2acc60da8c6793c609946f6d4082
SHA122e92e727cade7c6a9f69da5795410eba9c4e72c
SHA256636b8eecc558cc4e6312e93f87a0e0a014572fa0bfc9cf50b9311e4cead43b44
SHA512adab6b79ed056a6955ea90f72074624d96799dd8d88ecf5cf10bb514149e740031ab85217a6f41168cb6aa3573c77c8a8fd0e1497cc47d6be6e20f4d78f3632d
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB