General
-
Target
INV207537 130121.doc
-
Size
159KB
-
Sample
210113-e4clf7wh5x
-
MD5
d904dcff569da842a2774940ba27d4ef
-
SHA1
6c3beac50fb642123dfdcdc6633470bdc23af278
-
SHA256
5b6fda6bc66117f2cc1231e6e18c675988cc1250ae547a8c193cd1ed5869bc03
-
SHA512
73d1e34467472f90d6d88cfac0199dcab1eac4d489f09783b30d49d4e8bcfa078dd74646ab4cefd753ba95b8abfbe4de61307a0500ec97b1a8ab247b2ac85087
Static task
static1
Behavioral task
behavioral1
Sample
INV207537 130121.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
INV207537 130121.doc
Resource
win10v20201028
Malware Config
Extracted
http://ketorecipesfit.com/wp-admin/afanv/
http://mertelofis.com/wp-content/As0/
http://givingthanksdaily.com/CP/
http://datawyse.net/0X3QY/
http://cs.lcxxny.com/wp-includes/E3U8nn/
http://makiyazhdoma.ru/blocked/tgEeW8M/
http://trustseal.enamad.ir.redshopfa.com/admit/wJJvvG/
Targets
-
-
Target
INV207537 130121.doc
-
Size
159KB
-
MD5
d904dcff569da842a2774940ba27d4ef
-
SHA1
6c3beac50fb642123dfdcdc6633470bdc23af278
-
SHA256
5b6fda6bc66117f2cc1231e6e18c675988cc1250ae547a8c193cd1ed5869bc03
-
SHA512
73d1e34467472f90d6d88cfac0199dcab1eac4d489f09783b30d49d4e8bcfa078dd74646ab4cefd753ba95b8abfbe4de61307a0500ec97b1a8ab247b2ac85087
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Drops file in System32 directory
-