Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
15-07-2024 22:35
General
-
Target
$PLUGINSDIR/gc_license.rtf
-
Size
14KB
-
MD5
5190bd8d892384b72d0a7f5eb4364eb0
-
SHA1
4960e2af31f9dc90f6c8f864b8fb865150e76e97
-
SHA256
cd47392546a0b63061e33a431debd341f21755d794b59d14b6272ae895725db3
-
SHA512
718bd94078f78f074d6dee299aadd12041e1b7cee9a51aa8ce320477845d627259da76239ac1f10a87dd90135c1a9c83f65ddd6dc1eac4d18ef210a3cd2b6295
-
SSDEEP
384:PMxEXYxvXulMRXk///JGGl/q7yJQCTLDJTLSjYC12xx:VXYx2lW0/3JGGl/q76QCTPJTWYC12xx
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gc_license.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5213a79aa97b5a5629f1f9a56d2b85d05
SHA155f0ee35666dc4978ea9e4977cc59178654b9b4f
SHA256f38e8e2665b3f42ee87f1467dee6ee1e14b6bf28e81a803343b8e9ebe61ce609
SHA512732172877b550c8faf16275be7f8c5c7b00d6e6c44860ce44ac41d7a9643d0a96e126f990336918c9e08ee5470c0d937b8aa158bef0865201763b876204f54a5
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB