Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23-07-2024 10:21
General
-
Target
license.rtf
-
Size
55KB
-
MD5
961ae0fb01407fc89aaa5bf634257616
-
SHA1
e268e6cdecad3d181e3597907b98c77baa3a17da
-
SHA256
c807466525f0cc5d203d902d63d6357f953d5bddcbbece4abac8f61a9427304d
-
SHA512
ab105c3ca59e3c58c38144fde138c76fa28fd063f1da21cf89f068b7ba829437b3a1eb7e0badad8635c95a8165650e7212cb06482ceecf4afb262406980b8efe
-
SSDEEP
384:nAl5XLig8T6v370++IqUSsTEmuyuu3Eh4lGf5sEGtBlAzP4GfGuLsj3muA:Y5Xh0+FqUDUh4cBeDlAzzuO
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\license.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD59c4f99ee056cbbdbaa1ee42d82d261d4
SHA1d13bb512c020d34b1ee301bc369bd7d7b50ffdb3
SHA2564bea7be644c19d10edfca44273fe0c7fbdc528e494cef60f962c4710e9df7d94
SHA512590a844b870f7e0ce744bf15384cea82f7d9ffa89ca695e5696f0d8c9bfeccbc63f00af94edae8e5bf7ce3b982aeb9ad00089b9254df4224a460ccd9c0d784c1
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB