Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15-07-2024 22:35
General
-
Target
$PLUGINSDIR/license_GDS.rtf
-
Size
29KB
-
MD5
572c844641b7c89bd8e5c4b09db51eec
-
SHA1
7db62a97beda7fc9082e324ac0bcef1fb6ddd8d3
-
SHA256
9e4ada9fb4257e97feb8582c94f3a90c9a789d90c8cc45191eeffe7e90cf51c3
-
SHA512
74209b504f03749121dc76e95057981d5130f4fed5b718f64e95634ad0f32ebc611a61e7761d338eb470dddaf85c70897eb9132f57b181afe5139f248bf69547
-
SSDEEP
768:sWpF1sXIAbjZ+SjluFI7csb5ftkhL5UMHX6YZr/+nvwMwA2/Rk/CusmUHo:7L+fwR/q/lx
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_GDS.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD523600452d69334d0e89c0da3c52e8662
SHA112cd529ffbcd9e82f665ec2e5d75f7b39884dbee
SHA256bec46ba3131493d8f73521f3b44f97e73059f56c722cce3587429984d8ea3efb
SHA512d4ae698036d90e0fc4fcccf5169feeb7c81cbe388759c222769da64a6b33681e2b3e18ef29165cf788050c0f0e8a9939105eccacb0af13bb58e5e5b54b63aa60
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB