Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23/07/2024, 09:01
General
-
Target
Readme.rtf
-
Size
4KB
-
MD5
f48b1c6feb2a69b3bc567c79999a5862
-
SHA1
7d9c9b8296f3fee40151228f302a5c9c82a8ad15
-
SHA256
be9d95460a750f3ad4a5e75b4122868cdea2ea65cd2f42141b217bcc546e8281
-
SHA512
9b32cc9b60f32c23f08857299d653f46fe1b6b06e425006550ea42f76a0753b5fe17cf31f6de2d27d03c961a48512d698717c88fb437d479d9b560d704d7d7de
-
SSDEEP
48:fR3c6uCUdaSd5olWzWBtcqAddAo+7dvSzVAU6ZzEHiieH2do0fHYwZjJ0oUr4frn:fRktdpeE9/YbsDFm/exmw0m6nblAMs
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Readme.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5c8c959f90f14f42425ef3fd7c498f0b7
SHA1a95f9376cbffd5c67166113182854755b5484f0e
SHA2566a50fa04d2814ddfe1544106da3fe08a95175cfb60889d795723f0cd6f92bbed
SHA512c092913baf5709662334651fad505c93950e504ca0c8054f88ab32211af936bc151a70e93f7fc495a419f73445369dc5f04321d8e0ac142e4ed31989cc229a18
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB