Overview

overview

10

Static

static

8

PO-465514-180820.doc

windows10-1703-x64

10

PO-465514-180820.doc

windows7-x64

1

PO-465514-180820.doc

windows10-1703-x64

10

PO-465514-180820.doc

windows10-2004-x64

10

PO-465514-180820.doc

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO-465514-180820.doc.zip
  • Size 99KB
  • Sample240103-ydcrkshcfq
  • SHA256 69c925d0b4cc3466d99f6c8615dd15051c3e9a79c22914e3766cdb69590979f2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://52550750-56-20180826151453.webstarterz.com/savewayexpressthai.com/jnze_2o3j_k/
  • exe.dropper

    http://oubaina.com/wp-includes/lqkz_nvr_1avf4/
  • exe.dropper

    https://www.msbc.kz/data/k527_5_cbdvv5bi19/
  • exe.dropper

    http://okcupidating.com/im/fsq_esj_qgx060p/
  • exe.dropper

    http://bike-nomad.com/cgi-bin/7n_0x0_62mnzyh9q/

Targets

    • Target
      PO-465514-180820.doc
    • Size 174KB
    • SHA256 044aa7e93ec81b297b53aaebad9bbac1a9d754219b001aaf5d4261665af30bc7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Enterprise v15

Tasks