Analysis
-
max time kernel
0s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 00:29
General
-
Target
089c846d6e0e740ee0a4a8b3bd409cad.doc
-
Size
612KB
-
MD5
089c846d6e0e740ee0a4a8b3bd409cad
-
SHA1
2ba96ba3055f35ce4c5b8d7acc5b99c11db02986
-
SHA256
7336cd3bd33bed303b35a019ad2e354bc2a2bb3249291ba9cd2eb98ecf7bfedf
-
SHA512
10b6ca55383aaa307246963870b293a757a22774a2f2d91698aab9e2f2355b134b9046da05a94866cc547d039ee10b3e5382c2e70976a08e134b9af005e2184b
-
SSDEEP
12288:AV9iQsDr8NReCz3DFw7m/kdxoF3aHUp6BvNoywaMFsZjjotAd5Rsm:AVXkr8NUCz6voFqDisSI7
Malware Config
Extracted
hancitor
1808_plfr
http://madmilons.com/8/forum.php
http://counteent.ru/8/forum.php
http://simatereare.ru/8/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122881⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\089c846d6e0e740ee0a4a8b3bd409cad.doc" /o ""1⤵
-
C:\Windows\SYSTEM32\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,DJJEQGVHMRG2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,DJJEQGVHMRG1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
816KB
-
Filesize
40KB
-
Filesize
32KB