Overview

overview

8

Static

static

3

Office_201...ws.exe

windows10-1703-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Office_2010_Windows.exe

  • Size

    690.8MB

  • Sample

    240423-rtx9wshb34

  • MD5

    27c07bdbae8fe90de9c65856489d28d0

  • SHA1

    a53f964cff6af7dd0d128106c9da153367a05ba2

  • SHA256

    c6001c86489490de1fc5ab5ee31d90d4c77530c762e82ad122c90580b9176d8a

  • SHA512

    a16313d53e02b125548ff92c27d690cac78c9b26510e0397c626deeb4d85eb19d5aa853d8252b903ec93a5b81976599613fb45a4fc5866e8dca56ed728ec13f3

  • SSDEEP

    12582912:ZCJexvMrccjkeYkUZnmHBDglKOxzG2A9bc1ZbIUefnzt1SJrX8LFkfVgjZP8g9:ZCJeOcK2n7lHk5BUitE1yqVIP8g9

Score
8/10
adwarediscoverymacromacro_on_actionpersistencestealer

Malware Config

Targets

    • Target

      Office_2010_Windows.exe

    • Size

      690.8MB

    • MD5

      27c07bdbae8fe90de9c65856489d28d0

    • SHA1

      a53f964cff6af7dd0d128106c9da153367a05ba2

    • SHA256

      c6001c86489490de1fc5ab5ee31d90d4c77530c762e82ad122c90580b9176d8a

    • SHA512

      a16313d53e02b125548ff92c27d690cac78c9b26510e0397c626deeb4d85eb19d5aa853d8252b903ec93a5b81976599613fb45a4fc5866e8dca56ed728ec13f3

    • SSDEEP

      12582912:ZCJexvMrccjkeYkUZnmHBDglKOxzG2A9bc1ZbIUefnzt1SJrX8LFkfVgjZP8g9:ZCJeOcK2n7lHk5BUitE1yqVIP8g9

    Score
    8/10
    adwarediscoverymacromacro_on_actionpersistencestealer

    • Office macro that triggers on suspicious action

      Office document macro which triggers in special circumstances - often malicious.

      macromacro_on_action

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks