Analysis
-
max time kernel
28s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
05-01-2024 06:38
General
-
Target
4302bf2881c2ede737ae438fb4427f01.doc
-
Size
431KB
-
MD5
4302bf2881c2ede737ae438fb4427f01
-
SHA1
a24199b5c55e2b8c35186d9d6189f36d15540bae
-
SHA256
643aac263025e8b90c9458a56508d49624e504c0dbf20bdc06f7630cf89d9035
-
SHA512
42c9f44fd937773ba546dfb11cbae0b77aad5615b8f2bb3c92c04cc30567c51f7f19549baa3ad88637808753b39ded6d283e884e1091e9bab4de4f5a93114a8d
-
SSDEEP
12288:ZV9iQsDr8NqClDfKTFi1w06/vbOes1AOrk4U:ZVXkr8NTNfKB30AOesoT
Malware Config
Extracted
hancitor
3008_hsdj8
http://buichely.com/8/forum.php
http://gratimen.ru/8/forum.php
http://waliteriter.ru/8/forum.php
Signatures
-
Hancitor
Hancitor is downloader used to deliver other malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4302bf2881c2ede737ae438fb4427f01.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,QIHTXYFJRAN2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 c:\users\admin\appdata\roaming\microsoft\templates\yefff.dll,QIHTXYFJRAN3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD53fac4c2bc0e1df2f9a22e89586420bbf
SHA1d84959d54a4d8f0e9b4a524df7717f855949abaf
SHA2561531ad8a66f69bdabe341d23ce2478278044e778c0731e7f1a38eb968aaadc3a
SHA51278b212c950350aa49b10a058c40eacf505a30aa9789f0039a29cbf0a146fda0585ec161dd9e9cf2ec3bd1b134a200dc356d34596e7a814385c875ac82c86d8f5
-
Filesize
4KB
MD55977f22dbb4b6bc8c6798e3a8c75f5c8
SHA119f61da7a6b6d15eaa4b474512cc99f0702e76b1
SHA2569eee0b9a1660e1fd140def0e4b8a9ab6a08b0cebcb392638dd8b0df970290378
SHA512f74e7259cf8a9f03061b5d881e01d37cea61520825c663dfd1b45cff032d7b2c6ce36d17a8b9fc17ab0b6be0baee0e0b8a7b3ab8469530c573ee5389c5cc8106
-
Filesize
241B
MD58963cb4123157464aa66928b3a910108
SHA1b9624233909e2bd04742654ba82288ab60528e73
SHA25659b4b5d813cd6d08d5895317ada4f6e5835286d7ecdf324f142474f34a22c565
SHA51287799850de5ae1d4f7aca70c22e68f873e6440565895dd7a029b9bde9af6004d09b9338b398aec43c9cc2eb9e78844edf8fde45c2efe8c7d97e8bbb783763f6c
-
Filesize
250KB
MD54e60aabe27e29e76b4020bcdbc796267
SHA1fee8b7619fa44dbb36a4b034f7f077969897346b
SHA25603efbcefa7c95f034a3bfe3d33406f1717977b5bfe53e130d70367f2896032f1
SHA512cff4d117508427c02bec0d317ebfe4a0b7a08c2e3c0e5bf92bb07e8e4c025a59134f13dc22157b2eee69cecea91ff9eb6f6992166414e2b05c25dabb71c7c1a6
-
Filesize
21KB
MD5469f7b38028e6f0e5237c7748f1ebddf
SHA166ee62090fe2181c99bbce48c7afe10befdf0813
SHA256c07d2438a99b65c9e92ed8848c3070a1cac2d871d71467d2794a3bdc2d54a8a4
SHA5129204c4a05737f41f56e53461535cb071b8068ffff6e38f3e6c821df0608593c557129d0407598b9e075f191ca65856606e37b75dabfa32f4ff01817b06634546
-
Filesize
335KB
MD59ea5c5e87651e0f447ff1eb8d8029c87
SHA1b24df6220c5334b16effdc8580bac85444653918
SHA256c4de3e2af1fa741865c51ff2e151c2e2bee873f77bfce8fc2a2bb2785da6bb32
SHA512206e1b2f7d454af7bc052c79c7a80459a276c10ec67f0fe39a2ecfa9db35a27d9d6045c66d874cc7fb34688fd8afca1edd331b2e173c403013cce7130bfdd912
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB