Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
19/07/2024, 21:37
General
-
Target
$PLUGINSDIR/license_GDS.rtf
-
Size
29KB
-
MD5
572c844641b7c89bd8e5c4b09db51eec
-
SHA1
7db62a97beda7fc9082e324ac0bcef1fb6ddd8d3
-
SHA256
9e4ada9fb4257e97feb8582c94f3a90c9a789d90c8cc45191eeffe7e90cf51c3
-
SHA512
74209b504f03749121dc76e95057981d5130f4fed5b718f64e95634ad0f32ebc611a61e7761d338eb470dddaf85c70897eb9132f57b181afe5139f248bf69547
-
SSDEEP
768:sWpF1sXIAbjZ+SjluFI7csb5ftkhL5UMHX6YZr/+nvwMwA2/Rk/CusmUHo:7L+fwR/q/lx
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_GDS.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5532b2b96b5666dff131b456a037881a5
SHA18631a7e8b69277615889363ac18d15d50710f801
SHA256c4ed2f79d5b009535f87cf931fc280ceee3ea525bcbd2dcfd88ce53716539c6a
SHA5120f2ea96ca4ec7e0488f68e91e9aaaadcb04750b70b2776b08083f5eb1ca6fc31a7f18081b3064e50ba1f55b5b49b501a5934500c1e004d1605c3c70eabe37590
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB