Overview

overview

9

Static

static

1

order072724.docx

windows7-x64

9

order072724.docx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    order072724.docx.doc

  • Size

    93KB

  • Sample

    240726-1lhc5szcre

  • MD5

    d89c00ac44e63c962db8c02cbf0bab93

  • SHA1

    2ac1b269e93b1a0c0068b68d8d1d4f9e4a5cc06a

  • SHA256

    5dc96311ffca3ae13e805020a61d276e2a2b1032e2ecc87a05f86c346e90d47c

  • SHA512

    088c3b2a514fb1e5c504b29eb86302b8e8787e26dc6f6b0ea13ad6916676f16dc2650aa9b2a571c48fe6628311bd25f4a509830fd718b6444dac82308402739c

  • SSDEEP

    1536:LMzw/hgP0QF6smQKEMzqsQtrm5rbXkvMtLQ6j7jfmMIGSzyn5ivkSVkkKLkJem5Y:o0Q8hjOXIrbXyMtE6j/EfvkS8LrQY

Score
9/10
collectioncredential_accessdiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      order072724.docx.doc

    • Size

      93KB

    • MD5

      d89c00ac44e63c962db8c02cbf0bab93

    • SHA1

      2ac1b269e93b1a0c0068b68d8d1d4f9e4a5cc06a

    • SHA256

      5dc96311ffca3ae13e805020a61d276e2a2b1032e2ecc87a05f86c346e90d47c

    • SHA512

      088c3b2a514fb1e5c504b29eb86302b8e8787e26dc6f6b0ea13ad6916676f16dc2650aa9b2a571c48fe6628311bd25f4a509830fd718b6444dac82308402739c

    • SSDEEP

      1536:LMzw/hgP0QF6smQKEMzqsQtrm5rbXkvMtLQ6j7jfmMIGSzyn5ivkSVkkKLkJem5Y:o0Q8hjOXIrbXyMtE6j/EfvkS8LrQY

    Score
    9/10
    collectioncredential_accessdiscoveryexecutionspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Exploitation for Client Execution

1
T1203

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Query Registry

3
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks