General

  • Target

    INV207537 130121.doc

  • Size

    159KB

  • Sample

    210113-e4clf7wh5x

  • MD5

    d904dcff569da842a2774940ba27d4ef

  • SHA1

    6c3beac50fb642123dfdcdc6633470bdc23af278

  • SHA256

    5b6fda6bc66117f2cc1231e6e18c675988cc1250ae547a8c193cd1ed5869bc03

  • SHA512

    73d1e34467472f90d6d88cfac0199dcab1eac4d489f09783b30d49d4e8bcfa078dd74646ab4cefd753ba95b8abfbe4de61307a0500ec97b1a8ab247b2ac85087

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://ketorecipesfit.com/wp-admin/afanv/

exe.dropper

http://mertelofis.com/wp-content/As0/

exe.dropper

http://givingthanksdaily.com/CP/

exe.dropper

http://datawyse.net/0X3QY/

exe.dropper

http://cs.lcxxny.com/wp-includes/E3U8nn/

exe.dropper

http://makiyazhdoma.ru/blocked/tgEeW8M/

exe.dropper

http://trustseal.enamad.ir.redshopfa.com/admit/wJJvvG/

Targets

    • Target

      INV207537 130121.doc

    • Size

      159KB

    • MD5

      d904dcff569da842a2774940ba27d4ef

    • SHA1

      6c3beac50fb642123dfdcdc6633470bdc23af278

    • SHA256

      5b6fda6bc66117f2cc1231e6e18c675988cc1250ae547a8c193cd1ed5869bc03

    • SHA512

      73d1e34467472f90d6d88cfac0199dcab1eac4d489f09783b30d49d4e8bcfa078dd74646ab4cefd753ba95b8abfbe4de61307a0500ec97b1a8ab247b2ac85087

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks