Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
15-07-2024 22:35
General
-
Target
$PLUGINSDIR/license_pw.rtf
-
Size
27KB
-
MD5
1397d6205e393a50b8ed0b98bff4310f
-
SHA1
7eee5db6caea6603b3c21c65d6b3600d806916ba
-
SHA256
d74e676b28dcae57df5027f4167b107a4597a9ab99754d5844ae639b88e5ec85
-
SHA512
5bc18c65300ac2e0174f5a90002e9a9915c54efadc64d6d078fd4875412b5042e2e61d9a9a83cfedee596bce41eb5210b65f699a764fb8ae319a3031b99c8e95
-
SSDEEP
768:ExgL1TtcaEN0L25ovNmkRi6dHnlFarvevr2k:dsN35ov4kRi6dHlFarvevH
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_pw.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5725e1ea319ee0183d6494afc6370d596
SHA1ea62274bb733227254cd7215b6a0ae4b25b06abe
SHA25613d3ba59eadd1a36088b71789c2c7c7a67a9e99b6d272b3a00276319d937a65d
SHA5122d1fbbb4acbd09e207d0690021b5950d04a737ad2c3d0cda7d42236e1690b51cb5a104fa292c91946c9fdf1550c14373ea1df2d9cb9f692afc8decd49efc821a
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB