Overview

overview

10

Static

static

8

7b556613e2...2b.doc

windows7_x64

10

7b556613e2...2b.doc

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b556613e2f814670e721619781c1327dc6982655beef492a03e8b5449b7782b

  • Size

    180KB

  • Sample

    220201-f8y9yshdel

  • MD5

    bf448dd849e38068072e7f242e59a387

  • SHA1

    e70fca9132fd8b82a6409c2cb40b34062634f5e2

  • SHA256

    7b556613e2f814670e721619781c1327dc6982655beef492a03e8b5449b7782b

  • SHA512

    08091b6ee72fb42effb51f72be934dd8f4ca7e01f8c54ef4af12f6437ccfe8a006407d93e4c7240f9dda3bf1a0cda2349329bf2739c89b5bcc6f0575d2482a96

Score
10/10
macropersistence

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://animzzz.net/wp-content/I_0f/
exe.dropper

http://apnaoasis.com/wp-content/Y3_iT/
exe.dropper

http://acsboda.com/wp-includes/yn_gp/
exe.dropper

http://congchung.isocial.vn/img/6S_yF/
exe.dropper

http://www.axasta.com/wp-content/T8_Fp/

Targets

    • Target

      7b556613e2f814670e721619781c1327dc6982655beef492a03e8b5449b7782b

    • Size

      180KB

    • MD5

      bf448dd849e38068072e7f242e59a387

    • SHA1

      e70fca9132fd8b82a6409c2cb40b34062634f5e2

    • SHA256

      7b556613e2f814670e721619781c1327dc6982655beef492a03e8b5449b7782b

    • SHA512

      08091b6ee72fb42effb51f72be934dd8f4ca7e01f8c54ef4af12f6437ccfe8a006407d93e4c7240f9dda3bf1a0cda2349329bf2739c89b5bcc6f0575d2482a96

    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Sets service image path in registry

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks