Overview

overview

10

Static

static

8

SecuriteIn...87.doc

windows7_x64

10

SecuriteIn...87.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.W97m.Downloader.IWY.30727.7487

  • Size

    191KB

  • Sample

    200801-2baj114r46

  • MD5

    6ec1610259276cd008cf7af697b1f53d

  • SHA1

    d1696fb1fea73ab6bce7d5c4f81c6b4a146bb4de

  • SHA256

    69fda7852e8bb1536d60567e061a42139a071a604855852101bb0d4d3ffdaff8

  • SHA512

    dcb83ae01505f5c854d06b6fc94d30cc0205af40e56c23a70dd476a9ae4d217e6e38f742e89422b9960c3022ca7ed6924ac8d947c49f7bcd8e2ed661250c30ac

Score
10/10
discoverymacro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://mican.tri-comma.com/wp-admin/BmKOeycm0704/
exe.dropper

http://defensacovid.com/wp-admin/dGzIMVvo/
exe.dropper

http://doorbhai.com/wp-admin/Wq6Kdoisk1r4060453/
exe.dropper

http://agilentgame.reviewshell.com/cgi-bin/csoa45gw51315935/
exe.dropper

http://karir-up.com/wp-admin/CCzj96yk23/

Targets

    • Target

      SecuriteInfo.com.W97m.Downloader.IWY.30727.7487

    • Size

      191KB

    • MD5

      6ec1610259276cd008cf7af697b1f53d

    • SHA1

      d1696fb1fea73ab6bce7d5c4f81c6b4a146bb4de

    • SHA256

      69fda7852e8bb1536d60567e061a42139a071a604855852101bb0d4d3ffdaff8

    • SHA512

      dcb83ae01505f5c854d06b6fc94d30cc0205af40e56c23a70dd476a9ae4d217e6e38f742e89422b9960c3022ca7ed6924ac8d947c49f7bcd8e2ed661250c30ac

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks