Overview

overview

10

Static

static

8

SecuriteIn...25.doc

windows7_x64

10

SecuriteIn...25.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.W97M.DownLoader.4727.160.9125

  • Size

    170KB

  • Sample

    200801-k7vfgxstkx

  • MD5

    e285ce98290ef514e147ab84909a9500

  • SHA1

    88dc9e2c8defbafb4ef34b43c5d995b825c8b847

  • SHA256

    80565d4ed000d2c561645c79096f5e2fe04ac3f5c7e9e34ac68cb4ed9306ceab

  • SHA512

    1f2784e4a0bb236a136c068d95a4654c26aa6c034b3e1695d09483b81aceac20f66aa2a1d137618522d6425f3846ec58d4f8126447935a525263893be77303d5

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://johnsonlam.com/images/KO2l8V/
exe.dropper

http://jolapa.com/bobby/ll5P/
exe.dropper

http://joeljustice.com/images/OM4AD/
exe.dropper

http://joshuasjewelry.com/feed/JF5x9530/
exe.dropper

http://jothay.com/ClientBin/dyMrK85523/

Targets

    • Target

      SecuriteInfo.com.W97M.DownLoader.4727.160.9125

    • Size

      170KB

    • MD5

      e285ce98290ef514e147ab84909a9500

    • SHA1

      88dc9e2c8defbafb4ef34b43c5d995b825c8b847

    • SHA256

      80565d4ed000d2c561645c79096f5e2fe04ac3f5c7e9e34ac68cb4ed9306ceab

    • SHA512

      1f2784e4a0bb236a136c068d95a4654c26aa6c034b3e1695d09483b81aceac20f66aa2a1d137618522d6425f3846ec58d4f8126447935a525263893be77303d5

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks