70fa2300...7665 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Dropper
Downloader
Threat Names:
VBA:Amphitryon.1265
Gen:Variant.Graftor.596138
Gen:Variant.Zusy.308149
...

Pyongyang stores low on foreign goods amid North Korean COVID-19 paranoia.doc

Word Document

Created at 2020-12-23T15:02:00

...

Remarks (1/1)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "11 minutes" to "1 minute, 50 seconds" to reveal dormant functionality.

Indicators

File (27)
»
Filename Hash Operations Category Severity
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Templates\spolsve.exe MD5: f160c057fded2c01bfdb65bb7aa9dfcc
SHA1: 1e14de870b1c4b09cbf81206562a254c27178d85
SHA256: efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060
SSDeep: 6144:deSI8dD+Zp4IWoafJC8WVpH4dx98hNVVjr/:deSI8ha4ItNVVn
ImpHash: 35d1e2dd9caee6ca5d2146aa4334cd09 		Access, Create, Read, Write Dropped File
Malicious
C:\Users\FD1HVy\Desktop\Pyongyang stores low on foreign goods amid North Korean COVID-19 paranoia.doc MD5: 90a59c16d670fd77d710516299533834
SHA1: 25c0a651d7bdfdfca2f37160837829bea669c5f7
SHA256: 70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665
SSDeep: 384:Mo8AY64U4jOHgiI/6iSY5UFXoOfYxFSAtcwqVCM+V0hxtjiK6yOrX0jui3M:t/7dRc6lCMvxp6yOL5i
ImpHash: - 		Sample File
Malicious
0c26b620ab8e6837cbb9527f79a4cd029243b0da2f72c420f257fc4a2c6f4b44 MD5: 335fafc74a1d3a0caebc3e1896c46351
SHA1: 2081f4a1c334b5b498155f5629923f89c16325a6
SHA256: 0c26b620ab8e6837cbb9527f79a4cd029243b0da2f72c420f257fc4a2c6f4b44
SSDeep: 24:2dmMPmIAvy45SUtXYuwxvqmrxrqTt+YVbOr:cVmIAqySCYuQlowQm
ImpHash: - 		Downloaded File
Unknown
7017296fe4621fb5765b17dfc94485c7663d18f3cc35159f368899a55cce4ee5 MD5: 7955497d0248dbb62f643c3a5a62def5
SHA1: 1ea45f4793f6ac81f252a74dfd6a2423bd66b612
SHA256: 7017296fe4621fb5765b17dfc94485c7663d18f3cc35159f368899a55cce4ee5
SSDeep: 3:A7G0FDTa26XJT4W8YMlgh0Dec:A7G0NDaeYMlVp
ImpHash: - 		Downloaded File
Unknown
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL - Access
Not Available
C:\ProgramData\360TotalSecurity - Access
Not Available
C:\ProgramData\AVAST Software - Access
Not Available
C:\ProgramData\AVG - Access
Not Available
C:\ProgramData\Avira - Access
Not Available
C:\ProgramData\Bitdefender - Access
Not Available
C:\ProgramData\Comodo - Access
Not Available
C:\ProgramData\Doctor Web - Access
Not Available
C:\ProgramData\ESET - Access
Not Available
C:\ProgramData\Kaspersky Lab - Access
Not Available
C:\ProgramData\Norton - Access
Not Available
C:\ProgramData\Panda Security - Access
Not Available
C:\ProgramData\Sophos - Access
Not Available
C:\ProgramData\a7963 - Access, Create
Not Available
C:\Users\FD1HVy\AppData\Local\Temp\VBE - Access, Create
Not Available
C:\Users\FD1HVy\Desktop - Access
Not Available
C:\WINDOWS\SysWOW64\cmd.exe - Access
Not Available
Normal - Access
Not Available
System Paging File - Access, Write
Not Available
\??\C:\Users\FD1HVy\AppData\Local\Temp\Liebert.bmp - Access, Create, Write
Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Templates\spolsve.exe - Access, Create
Not Available
\??\C:\WINDOWS\SYSTEM32\ntdll.dll - Access, Create
Not Available
c:\programdata\a7963\tlworker.exe‡kk”v–p¤j0“8q - Access, Create
Not Available
Registry (45)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Access, Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access, Create
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
Domain (1)
»
Domain Sources Severity
www.rabadaun.com Function Log, PCAP
Unknown
URL (2)
»
URL Operations Category Severity
http://186.122.150.107/cc/index.php POST Contacted
Blacklisted
https://www.rabadaun.com/wordpress/wp-content/themes/TEMP.so get Contacted
Unknown
IP (2)
»
IP Protocols Sources
134.0.11.201 HTTPS, DNS, TCP Function Log, PCAP
186.122.150.107 HTTP, DNS, TCP Function Log, PCAP
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image