Overview

overview

10

Static

static

8

INV207537 130121.doc

windows7_x64

10

INV207537 130121.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    INV207537 130121.doc
  • Size 159KB
  • Sample210113-e4clf7wh5x
  • SHA256 5b6fda6bc66117f2cc1231e6e18c675988cc1250ae547a8c193cd1ed5869bc03
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://ketorecipesfit.com/wp-admin/afanv/
  • exe.dropper

    http://mertelofis.com/wp-content/As0/
  • exe.dropper

    http://givingthanksdaily.com/CP/
  • exe.dropper

    http://datawyse.net/0X3QY/
  • exe.dropper

    http://cs.lcxxny.com/wp-includes/E3U8nn/
  • exe.dropper

    http://makiyazhdoma.ru/blocked/tgEeW8M/
  • exe.dropper

    http://trustseal.enamad.ir.redshopfa.com/admit/wJJvvG/

Targets

    • Target
      INV207537 130121.doc
    • Size 159KB
    • SHA256 5b6fda6bc66117f2cc1231e6e18c675988cc1250ae547a8c193cd1ed5869bc03
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks