Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
20-07-2024 21:56
General
-
Target
cateran.docx
-
Size
32KB
-
MD5
6ca0f9855f89f8d5b7c66afa03e9d333
-
SHA1
02bf7c58da5576d86f77699a5aaa2d059c254983
-
SHA256
24c74262346636f63b0c1afdb64ff000244610ad2ad6a46acb6a596433fede60
-
SHA512
0ba90446e7f6290f90d3b8b99ee0e8c03cd39e623cbd4ae4ab748c6174d52424b49ab50e765ae71fe278363f8c883c50a65a8e817c788d4a3930fffecab0cfe3
-
SSDEEP
768:hSMDC5ZCKOFpt292gaJgB6FZuD26V53Ln/p/uRb0lUE8/QZfueL5:457Ojt292gpIZubV53Ln/hul0Kw91
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\cateran.docx"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5c60af0d411962c4bc2ad3565b4d6fcfc
SHA1cfe181cf1a53ed689d699ab8b8ca7d1643b03be9
SHA256ae0f3ea35bee9acebd3733f17d7483fc9b2971086113e19be4408159fbc2cb3c
SHA5126ea2448b1bddca813b3798552582d89b02f090e42b053dd3d138fb588a443cc205aea7fa89605b1a9a3935b4307b50891062581c1d35ee1fce0c6e9e844cb591
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB