Analysis
-
max time kernel
100s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
20/07/2024, 07:00
General
-
Target
$PLUGINSDIR/filebulldog.rtf
-
Size
49KB
-
MD5
631f2949e010cec263adefaf4ef669ea
-
SHA1
7fcbdd13243b97c3fb82d3e4ff919de8e514473c
-
SHA256
f9daeeb2bf87842cdcfcca7ac228b827c81f692aa55a43fe9d1eaad24790c067
-
SHA512
048b49e62cde89f082318ef9bc63519fd635b1b0384c84de87d7f2327efec78a07a1e3f11763b72092fd53eae8e5d83ade98d61ef319b4a492d597be4f3f98f1
-
SSDEEP
384:gNaUnXkFKw0zybd6NgYUlvaH/se494ZZz/m4gnNzhuzY3+lXFL+GK9vi6rGs2AYE:gNqYUlvaH//vDgNzw83jwhAkhe
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\filebulldog.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD53849296ce5d0585cc0a5aa5e2859c9f2
SHA1e571cdb0a29ba4424dd0da1a9748968603475e2f
SHA25623ce6fb50923f1b202f916431a626b1af622c816595fd623df2ee244d9a22b47
SHA51215ee6e19eb9f5698d97d212a6f1dd2a40455798e2e36dadb3b2ac6b8e97f7c8e0f546f2da199274603de11875ebefd05b59908b1b52a53742f7d6e103e9d6d06
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB