Overview

overview

10

Static

static

8

0717eeb278...1f.doc

windows7_x64

10

0717eeb278...1f.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0717eeb278ee42735001408147062d6fb92f5fe6fcb9b90231b3fe79b6ffee1f.zip

  • Size

    86KB

  • Sample

    210113-68932j9hd6

  • MD5

    307a6e2f24d3cf49ac5bb0b6fc622568

  • SHA1

    25cc827eb4aecef750d521cfa645c68430a8410e

  • SHA256

    cc7d2b678e034e6e0129e2ea4ca594444dcb04aee9bbee0943349b5578ad440b

  • SHA512

    0c00c7ef152d1e7385ceae84c7766d2227e5c0d50db588a3081ffe4f70a6e5afe779ef77af4485b0e0fcb93505ae73c0a772db49116597f6d49106187d9c0e4b

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://fynart.com/wp-admin/aNuMy/
exe.dropper

http://dermedicoclinic.com/js/NElI8ZC/
exe.dropper

http://geolifesciences.com/font/r/
exe.dropper

http://rollinghood.com/how-to-ifwed/buj6VQx/
exe.dropper

http://jardindhelena.com/wp-content/u20/
exe.dropper

http://kingshowworldshoppingmall.com/cgi-bin/Ga/
exe.dropper

http://davinciworldshoppingmall.com/cgi-bin/Eh/

Targets

    • Target

      0717eeb278ee42735001408147062d6fb92f5fe6fcb9b90231b3fe79b6ffee1f.doc

    • Size

      158KB

    • MD5

      97a4cbc590b64fcb705316e7442438ea

    • SHA1

      6786718e802b4ee95a7bc3fcb96a6e20ec84b812

    • SHA256

      0717eeb278ee42735001408147062d6fb92f5fe6fcb9b90231b3fe79b6ffee1f

    • SHA512

      4713d1c32f78542eb213425485809075145ccc36f6a198c40f9534d6d6c7e65acd936bcfa717a501f14999946e1a6df84bdc91d6589609fc7e304bddde795d26

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks