a91345c766f145d47d6deb90c3ae9d920f28101e12e39d93e88e3612eaf07329

General

Target

Boendet.docx
Size

21.7MB
Sample

240520-kgpnnabh33
MD5

14b980a65c7501e12ccfecd9bf55cb16
SHA1

7bf794b9b674f5946eadb8e07a01d6aaeb337d7f
SHA256

a91345c766f145d47d6deb90c3ae9d920f28101e12e39d93e88e3612eaf07329
SHA512

a6758a6617f420ac3a49bbfbb055f43a2d5fbfa3611030e359d6ff788b7276f4c005a0e04c9cbc776dcf02e0ddc30b6bb55d1c8758b1822ad6e3cc612a54a504
SSDEEP

393216:9/K/AmXAr22JMg1Ml30SRiGHVdrc5nw0DxTceN+ujRIT++9kkG:4/Ar2XRiSdrc5w0DxTb3RITBeN

Score

10^/10

Malware Config

Targets

- Target
  
  Boendet.docx
- Size
  
  21.7MB
- MD5
  
  14b980a65c7501e12ccfecd9bf55cb16
- SHA1
  
  7bf794b9b674f5946eadb8e07a01d6aaeb337d7f
- SHA256
  
  a91345c766f145d47d6deb90c3ae9d920f28101e12e39d93e88e3612eaf07329
- SHA512
  
  a6758a6617f420ac3a49bbfbb055f43a2d5fbfa3611030e359d6ff788b7276f4c005a0e04c9cbc776dcf02e0ddc30b6bb55d1c8758b1822ad6e3cc612a54a504
- SSDEEP
  
  393216:9/K/AmXAr22JMg1Ml30SRiGHVdrc5nw0DxTceN+ujRIT++9kkG:4/Ar2XRiSdrc5w0DxTb3RITBeN
Score

10^/10

evasion macro macro_on_action persistence trojan upx
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Office macro that triggers on suspicious action
  Office document macro which triggers in special circumstances - often malicious.
  macro macro_on_action
- Suspicious Office macro
  Office document equipped with macros.
  macro
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
behavioral1