Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
21-07-2024 12:49
General
-
Target
asar/linux安装asar文件解压打包组件.docx
-
Size
16KB
-
MD5
973a163e8cb4d6c4da477dd6e6b78063
-
SHA1
c25cdc29859d0131971c5122bc5de1ff6b64e5f6
-
SHA256
e58679811fe06fd16642942a8f61b77eb8c5f3efcee7396ec5e41b77da46d7dd
-
SHA512
c897f7bd124053118063d8a28a71b2ee2e4245d9726d63176541921eb415a9dfecda195260d11b2f4cf91fab428a97faa62cbd347c1dff82dc012c3739f19743
-
SSDEEP
192:jhvAkoUR7fznSqqi6+zxFgbET6sjbnlJ1jtyQDubjya4LOrgDBIwMIT1TkRiW:d7bRnnzqi6q2oTjjlwQDubmxqgFSpRiW
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\asar\linux安装asar文件解压打包组件.docx"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5edfdae071105eb66cbcf94826ad819f3
SHA1b457d3fe9c79c5105e20d1b3a2ff3cfa2d049e27
SHA25619a4baccb2dfe9b2cba3d28c098b42b2c5c74a690f1ee69918a25d0395fc7478
SHA5122f7c2a15e3fea5cb8187072e24d9b4665b5f8c6968c3d3a669dc9b5b74001f49fd507a153e822e7b1aed56857f73daeaa8b894a6c4b9c5d5e2dc263a1b2ed85a
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB