Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20/07/2024, 07:00
General
-
Target
$PLUGINSDIR/dealbulldog.rtf
-
Size
60KB
-
MD5
86d815dee4ed827f8d65f7c3e667ea8f
-
SHA1
bf59d20b20780b137325eb1f13303d2b6dbcebc0
-
SHA256
7411fb4a51d517e1f657b52b0473243bfb4594193f9ea74cd82e1658cda9da12
-
SHA512
cfad1960d535439d4d9560635391e4ade80b1afc3344d037fd6a53a2a5d77bd8b9c467ee9c42fcdea662602e2dbf520ab9dcf48a83323be7cf93a2ffe315adf1
-
SSDEEP
768:IEGRYm4xhN6DEi3w2EHIDui3w2EHHTuDLXI1n2GzcEYFDN2yLzCGpVM36nC6ZrSs:InROyLOGLM3qTDh
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dealbulldog.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD577a5c312728c3d44c4cbe426c1a073d0
SHA1528c28dde3daf40829591d6bb7069047a8452a5b
SHA256382fd0e2ba5f8528ee61921a60138fbe9e2ab7594fa9b1233a227de06d9c8e98
SHA51211f2fab3f5d6d10512e2a218480981adc5ea1ff32a73e2c20492ecfad519582c9616b4bde00031ee2ecf44ecdb0aebd19b681a54cb41f5bb389b9ea7ac1fcb0c
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB