Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
22/07/2024, 17:29
General
-
Target
$PLUGINSDIR/license_iolo.rtf
-
Size
61KB
-
MD5
fa686d2f6cee9080150b9c273db7e8ef
-
SHA1
1d9d4db6acdf6c9af6036cc1dc9766a65fe3d298
-
SHA256
9b22e04dd604b521d2f94d5f2f5381b63e4dec75c2ec644605d519070ef2b45e
-
SHA512
46013e6e6e53ca4dd65409e6f42010536f3133e1bacf3266b1e4acbcce5bc7120881fb1105c538103fef415e4125d0537cfbbfe5a3c6b6d55d1448c94f86c334
-
SSDEEP
768:dK6DBjUzF50JEuRwRzR0R1btqYr2wW5VU9YuWcfjWQ7L2vBIBYmSSQJ6j2jCjAcB:sJ5uByJ6BudgboXY
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_iolo.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5dd7ff865185b156e7a7d616ded6aa267
SHA13a27c99d8b8cc0734aa2b9386eab188f05231d02
SHA256a0bb23cdf153ec492635764a8b7b17d84bfbd733e4c2cae908b68cf486ed211c
SHA5128dc29eb5b5ddd91834c10a097e81a3ebf387b8d6a28b2ed19db8592276de0d72b70d4150882a25ab68916a8cd2809bb7225a7e751cfdddc3714fddeaecd853fa
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB