Overview

overview

10

Static

static

8

60270607938.doc

windows7_x64

10

60270607938.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60270607938.doc

  • Size

    165KB

  • Sample

    210121-by91pgrg16

  • MD5

    f0abfae752760647617b6dc98bf0acf8

  • SHA1

    dfb3be8a8cfe747831dfe2bdbb4b22cb93b1a968

  • SHA256

    a8433ba5155ff6c3f6af45096b5332ad01bbb825bd9f54c2964ed875d379a604

  • SHA512

    0def29bbbc0ba57c1569eadfa87f61f08bfb391c70e0f454e9b2cf08834f68ef45a7763f7cc8d55748944aa0a3569513a9bd432fdbea59546a70625ea8ba383c

Score
10/10
macroransomwarexlm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://trainwithconviction.com/wp-admin/y/
exe.dropper

http://trainwithconviction.webdmcsolutions.com/wp-admin/rEEEU/
exe.dropper

https://perrasmoore.ca/wp-admin/rM6HK/
exe.dropper

https://canadabrightway.com/wp-admin/n3/
exe.dropper

https://upinsmokebatonrouge.com/var/Ux1V/
exe.dropper

https://thelambertagency.com/staging/Vo/
exe.dropper

https://stormhansen.com/2556460492/if/

Targets

    • Target

      60270607938.doc

    • Size

      165KB

    • MD5

      f0abfae752760647617b6dc98bf0acf8

    • SHA1

      dfb3be8a8cfe747831dfe2bdbb4b22cb93b1a968

    • SHA256

      a8433ba5155ff6c3f6af45096b5332ad01bbb825bd9f54c2964ed875d379a604

    • SHA512

      0def29bbbc0ba57c1569eadfa87f61f08bfb391c70e0f454e9b2cf08834f68ef45a7763f7cc8d55748944aa0a3569513a9bd432fdbea59546a70625ea8ba383c

    Score
    10/10
    ransomware

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks