Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
22-07-2024 17:29
General
-
Target
$PLUGINSDIR/license_rr.rtf
-
Size
28KB
-
MD5
5cbcfdf6dba0b92aaeef61de113e1d57
-
SHA1
438407cbea0184258a96fabd1b73d4c97389974f
-
SHA256
3fd075e818ebea8d955a7bd19808fa41297fcaee13f08f18815f1f091ec29215
-
SHA512
7196437ed731cf9b9847266e64b1e99c8ce9b5afcc5a2650882ac6543a70bf370df26c9f6148feade80e9e8b11d0035936b3edaf1c6b98d5420459fb9e6e3f9a
-
SSDEEP
384:WMGugFH3F1sxxaZzTBOLVkQkQiDWuQ63ooqqrob8ZH0jtTzdZXLRy5:OH3F1sxxaBNGiiuQ7onrowHotTzje
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_rr.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5100643f5ece213f32cbf72b3cbfcf36e
SHA19d2e915b6d4028ba58281de989fe716e6f2317ef
SHA256e0aab92ddbf201e2a46d0c35cba7c152736677081821485d7ca4edc07ad9cbeb
SHA5129fe954ab7f80fac69ad9d495465c029920cf1590db54da27f13495ca63b0c97486f0b1ba9880c3fac1b4679d7f7dc2dd09e3696fd921bceade8bae52d6c4bd5e
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB