Analysis
-
max time kernel
101s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
15-07-2024 22:35
General
-
Target
$PLUGINSDIR/license_iolo.rtf
-
Size
61KB
-
MD5
fa686d2f6cee9080150b9c273db7e8ef
-
SHA1
1d9d4db6acdf6c9af6036cc1dc9766a65fe3d298
-
SHA256
9b22e04dd604b521d2f94d5f2f5381b63e4dec75c2ec644605d519070ef2b45e
-
SHA512
46013e6e6e53ca4dd65409e6f42010536f3133e1bacf3266b1e4acbcce5bc7120881fb1105c538103fef415e4125d0537cfbbfe5a3c6b6d55d1448c94f86c334
-
SSDEEP
768:dK6DBjUzF50JEuRwRzR0R1btqYr2wW5VU9YuWcfjWQ7L2vBIBYmSSQJ6j2jCjAcB:sJ5uByJ6BudgboXY
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_iolo.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5a3672821b265d8a0fd923f919f627332
SHA17bf33a2b0a8cccddaaad8b1009f8e5c96a6f4f1b
SHA256dddea0a3f5000423af7872a563b7a46b78fa2b2e421ff98c362dd601cd092dbf
SHA512ec8cd2771300c3ef99a843d8744039eafc06e373cbaa49a7f850e73184bf1436338253d83b1ea7a61e22e3595f5c4bbf8c40512549080475cc5b4c8315410242
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB