Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
13-07-2024 11:04
General
-
Target
$PLUGINSDIR/Iminent_license.rtf
-
Size
56KB
-
MD5
cbd9c82da4e208d7e2bec6dd37879174
-
SHA1
d7661afdb253df33aebad995aca8554da8b9cf53
-
SHA256
37e54e99851d09a66355021526fab376fce93288a2bbfaea7cd993356040e543
-
SHA512
39502dec4b6ffc80375186590fce0957a6790592382739742656061d889950ad160074a1573a94e049aa302a3196f0a652af6bb533ebf0498f707ef75adb20d4
-
SSDEEP
768:aE6m+kHbNZ/caU0MI6M1/caU0MI6Mn/caU0MI6MQ/caU0MI6Mvejq6CRFQ5/caUH:Nj/lb8W3YncXMYXip7RWKL9cOf
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Iminent_license.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5f1c10cb4158d21dc75722b9e2f6f8400
SHA141b3337e701da0d414070ea6a5b6bd6fa4ff9cdf
SHA25686b180f5314e5bfdce0b0efe49f474ed218dcb3466f3b8cf62f3135dc1c1af40
SHA512e14dad9e759415c10f04f5cb7a8e255d575cc7c0a3251e9017f2629fcd61aaaf25437480d5e9a9d9f578f1bd68c805c3ace4cc884b9178691a6b1e28c631ac7f
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB