Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15-07-2024 10:54
General
-
Target
$TEMP/license.rtf
-
Size
14KB
-
MD5
9c60360230bab0ee76cf11031ba86822
-
SHA1
8b4e2a691e621723dd4bfb77306eefbc35973056
-
SHA256
67dbb7f016bee192b1e90a527cd56482076776ac91ccacc77d647d1a7abe18e8
-
SHA512
3336aae2fb1d0ca86713daf1135ce1b91b3fffb412a0903d07ca30254202109f5fd1dc4dc8d68213da243895fe80a25f55a63315603cde05ed0b7c0e7e46dfaa
-
SSDEEP
384:aKSgUybmrZ1jEIGi2wUYlwTMBLjxGUs6uZw2Rp1S7:sy6rZ14If2wUYlwTMBLjxGUs6uZw2Rpc
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$TEMP\license.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD52e235a62c9d170722f4084f0cb588775
SHA10fc1d9e30db64088be7c31a392d8ded4a9c486bf
SHA256c782c34c6cfae5d484bb4d10207b291b203ad2c964eeeab16203bf492fbdfb42
SHA512750626da7531d5be07fc0a5ef0550b57704b05e107edadc82edfa7f23c3b84676055cc2da451baca28d8814df963e910b6ca25aa404feaded9183b0241085e45
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB