General
-
Target
Scan_162634080-685.doc
-
Size
160KB
-
Sample
210114-1jswazs6sx
-
MD5
456c6fc6dddd89c3d34f683fb974408e
-
SHA1
27076ccc6fa151353765e1f9b2bdd40000593f30
-
SHA256
de6807e58f73aaf246c69c64fd9c2ef76d11c6fa84f3580f62de58ec8d2d7d55
-
SHA512
b2a1dc99a03591ea5a76a6e0ef70b5155a235c03a49d0372d636587a53ec86f94a7d6f3ebec63b3a7c6ec72497ed1b52671dc43ceb7c4344c627cb56e00cb928
Behavioral task
behavioral1
Sample
Scan_162634080-685.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Scan_162634080-685.doc
Resource
win10v20201028
Malware Config
Extracted
http://ketorecipesfit.com/wp-admin/afanv/
http://mertelofis.com/wp-content/As0/
http://givingthanksdaily.com/CP/
http://datawyse.net/0X3QY/
http://cs.lcxxny.com/wp-includes/E3U8nn/
http://makiyazhdoma.ru/blocked/tgEeW8M/
http://trustseal.enamad.ir.redshopfa.com/admit/wJJvvG/
Targets
-
-
Target
Scan_162634080-685.doc
-
Size
160KB
-
MD5
456c6fc6dddd89c3d34f683fb974408e
-
SHA1
27076ccc6fa151353765e1f9b2bdd40000593f30
-
SHA256
de6807e58f73aaf246c69c64fd9c2ef76d11c6fa84f3580f62de58ec8d2d7d55
-
SHA512
b2a1dc99a03591ea5a76a6e0ef70b5155a235c03a49d0372d636587a53ec86f94a7d6f3ebec63b3a7c6ec72497ed1b52671dc43ceb7c4344c627cb56e00cb928
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Drops file in System32 directory
-