Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 08:16

General

  • Target

    $PLUGINSDIR/filebulldog.rtf

  • Size

    49KB

  • MD5

    631f2949e010cec263adefaf4ef669ea

  • SHA1

    7fcbdd13243b97c3fb82d3e4ff919de8e514473c

  • SHA256

    f9daeeb2bf87842cdcfcca7ac228b827c81f692aa55a43fe9d1eaad24790c067

  • SHA512

    048b49e62cde89f082318ef9bc63519fd635b1b0384c84de87d7f2327efec78a07a1e3f11763b72092fd53eae8e5d83ade98d61ef319b4a492d597be4f3f98f1

  • SSDEEP

    384:gNaUnXkFKw0zybd6NgYUlvaH/se494ZZz/m4gnNzhuzY3+lXFL+GK9vi6rGs2AYE:gNqYUlvaH//vDgNzw83jwhAkhe

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\filebulldog.rtf"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2632

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      60454662061fc5c741e58b378166f315

      SHA1

      da5039f4fd2d49e7544055b09a2d26dca1af75ed

      SHA256

      a758d6e442a76d27287147a6fb6421c85daeceee04ba4394e032f67f337891b2

      SHA512

      e351904d0936f46a36957ee22f8a9bae6f81970e0802bdc0fd894716fc85b0c303bba6861b4571182e29dc7bfec8204583e9b74aebc7e0c77e1a13152dcc90e5

    • memory/2884-0-0x000000002FB21000-0x000000002FB22000-memory.dmp

      Filesize

      4KB

    • memory/2884-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2884-2-0x000000007181D000-0x0000000071828000-memory.dmp

      Filesize

      44KB

    • memory/2884-5-0x000000007181D000-0x0000000071828000-memory.dmp

      Filesize

      44KB

    • memory/2884-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB