Overview

overview

10

Static

static

8

CEWA Techn...20.doc

windows7_x64

10

CEWA Techn...20.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    CEWA Technologies, Inc - Oct 27, 2020.doc
  • Size 180KB
  • Sample201028-25h8474ads
  • SHA256 7c7217a804b48c65da9cb5b6ceb4fe283bf676970cab39465098d7decdbc1b5d
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://car4libya.com/cgi-bin/sDBhPqx/
  • exe.dropper

    http://ostranderandassociates.com/var/thpY/
  • exe.dropper

    http://acredales.com/thank_you/U0u9Z/
  • exe.dropper

    http://scw8.net/wp-content/1MkWc/
  • exe.dropper

    https://adinterix.com/laybuy-investors/9Ab6/
  • exe.dropper

    http://uxnew.com/old/9/
  • exe.dropper

    http://www.queensport.nl/accp/dz/
  • exe.dropper

    https://bahamianrelief.org/VpHo/ey/

Targets

    • Target
      CEWA Technologies, Inc - Oct 27, 2020.doc
    • Size 180KB
    • SHA256 7c7217a804b48c65da9cb5b6ceb4fe283bf676970cab39465098d7decdbc1b5d
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks