Overview

overview

10

Static

static

8

KPU400GPY1720.doc

windows7_x64

10

KPU400GPY1720.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KPU400GPY1720.doc

  • Size

    166KB

  • Sample

    210121-9c9wewqa12

  • MD5

    3eff3709efa827fc4f9673615c8537f7

  • SHA1

    d2515f19045e5473b0e3d3a0c48596d279c141a9

  • SHA256

    055e1fe89e4daa151fe649949779e67b4b4a4f1cdb9ada40550b6ab0960f71ce

  • SHA512

    93639555a7ca82be41de7ac46083a9f916b01757baacd163c28c5fa8a91760af382be420623941dfbb171413b0f245b15ee8196f5e07a19564fe044a1df164ee

Score
10/10
macroransomwarexlm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://trainwithconviction.com/wp-admin/y/
exe.dropper

http://trainwithconviction.webdmcsolutions.com/wp-admin/rEEEU/
exe.dropper

https://perrasmoore.ca/wp-admin/rM6HK/
exe.dropper

https://canadabrightway.com/wp-admin/n3/
exe.dropper

https://upinsmokebatonrouge.com/var/Ux1V/
exe.dropper

https://thelambertagency.com/staging/Vo/
exe.dropper

https://stormhansen.com/2556460492/if/

Targets

    • Target

      KPU400GPY1720.doc

    • Size

      166KB

    • MD5

      3eff3709efa827fc4f9673615c8537f7

    • SHA1

      d2515f19045e5473b0e3d3a0c48596d279c141a9

    • SHA256

      055e1fe89e4daa151fe649949779e67b4b4a4f1cdb9ada40550b6ab0960f71ce

    • SHA512

      93639555a7ca82be41de7ac46083a9f916b01757baacd163c28c5fa8a91760af382be420623941dfbb171413b0f245b15ee8196f5e07a19564fe044a1df164ee

    Score
    10/10
    ransomware

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks