Overview

overview

10

Static

static

8

DOC_CF4U7I...3L.doc

windows7_x64

10

DOC_CF4U7I...3L.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DOC_CF4U7ICWH4K2NZ3L.doc
  • Size 187KB
  • Sample200916-4yge3n1gsa
  • SHA256 fcb293cfa69d4cbbc6afa71ad0a6456746863f91a54c2af300ca91c088f9c2f4
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://dtyl.shop/wp-content/W68Nx/
  • exe.dropper

    https://star-speed.vip/wp-admin/U2jRIg/
  • exe.dropper

    https://cshub123.cn/wp-admin/Gajs/
  • exe.dropper

    https://viettellogistics.com.vn/wp-content/oS4/
  • exe.dropper

    http://cococat.se/wp-admin/2Oaf/
  • exe.dropper

    http://andresirjan.ir/wp-admin/JSH/
  • exe.dropper

    https://sptrade.com.br/wp-includes/iFZOvL/

Targets

    • Target
      DOC_CF4U7ICWH4K2NZ3L.doc
    • Size 187KB
    • SHA256 fcb293cfa69d4cbbc6afa71ad0a6456746863f91a54c2af300ca91c088f9c2f4
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks