a72e6bef...4b70 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Dropper
Downloader
Threat Names:
VBA:Amphitryon.1265
Gen:Variant.Graftor.596138
Gen:Variant.Zusy.308149
...

1.doc

Word Document

Created at 2020-12-24T07:35:00

...

Remarks (1/1)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "16 minutes" to "2 minutes, 40 seconds" to reveal dormant functionality.

Indicators

File (27)
»
Filename Hash Operations Category Severity
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Templates\spolsve.exe MD5: f160c057fded2c01bfdb65bb7aa9dfcc
SHA1: 1e14de870b1c4b09cbf81206562a254c27178d85
SHA256: efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060
SSDeep: 6144:deSI8dD+Zp4IWoafJC8WVpH4dx98hNVVjr/:deSI8ha4ItNVVn
ImpHash: 35d1e2dd9caee6ca5d2146aa4334cd09 		Access, Create, Read, Write Dropped File
Malicious
C:\Users\FD1HVy\Desktop\1.doc MD5: d25dcc932a1e35ad7d30d8d474002a9e
SHA1: 3759f8e0e93a4b7d35843ba3cc06fdc8fc76abab
SHA256: a72e6befaa6cab0d3e5cf38046831d8e0a07c296f9fb5da16f97242e268c4b70
SSDeep: 384:io8AY64U4jONgiIvUyGcSxwAjLMgM084JDHVYc1Pd0jJJltpPXxCTlh3I/Ei:j/ff+qtHVR7aLfxCroE
ImpHash: - 		Sample File
Malicious
0c26b620ab8e6837cbb9527f79a4cd029243b0da2f72c420f257fc4a2c6f4b44 MD5: 335fafc74a1d3a0caebc3e1896c46351
SHA1: 2081f4a1c334b5b498155f5629923f89c16325a6
SHA256: 0c26b620ab8e6837cbb9527f79a4cd029243b0da2f72c420f257fc4a2c6f4b44
SSDeep: 24:2dmMPmIAvy45SUtXYuwxvqmrxrqTt+YVbOr:cVmIAqySCYuQlowQm
ImpHash: - 		Downloaded File
Unknown
7017296fe4621fb5765b17dfc94485c7663d18f3cc35159f368899a55cce4ee5 MD5: 7955497d0248dbb62f643c3a5a62def5
SHA1: 1ea45f4793f6ac81f252a74dfd6a2423bd66b612
SHA256: 7017296fe4621fb5765b17dfc94485c7663d18f3cc35159f368899a55cce4ee5
SSDeep: 3:A7G0FDTa26XJT4W8YMlgh0Dec:A7G0NDaeYMlVp
ImpHash: - 		Downloaded File
Unknown
7b4a7c7987a3369a6db20234da3b9789d913048e981d352493cd5608c2316ade MD5: 4c4e9399be1f937ffccd3e0ac1dba517
SHA1: 186ba56d73a56d61add69242e113aabfe8d41e46
SHA256: 7b4a7c7987a3369a6db20234da3b9789d913048e981d352493cd5608c2316ade
SSDeep: 6:TMVBd/JdWn8FH2Fic4svquXI9qvyn4mc4sVIHI6/KAEtm:TMHdmnMW0uXI9qvy45IOh4
ImpHash: - 		Downloaded File
Unknown
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL - Access
Not Available
C:\ProgramData\360TotalSecurity - Access
Not Available
C:\ProgramData\AVAST Software - Access
Not Available
C:\ProgramData\AVG - Access
Not Available
C:\ProgramData\Avira - Access
Not Available
C:\ProgramData\Bitdefender - Access
Not Available
C:\ProgramData\Comodo - Access
Not Available
C:\ProgramData\Doctor Web - Access
Not Available
C:\ProgramData\ESET - Access
Not Available
C:\ProgramData\Kaspersky Lab - Access
Not Available
C:\ProgramData\Norton - Access
Not Available
C:\ProgramData\Panda Security - Access
Not Available
C:\ProgramData\Sophos - Access
Not Available
C:\ProgramData\a7963 - Access, Create
Not Available
C:\Users\FD1HVy\Documents - Access
Not Available
C:\WINDOWS\SysWOW64\cmd.exe - Access
Not Available
Normal - Access
Not Available
System Paging File - Access, Write
Not Available
\??\C:\Users\FD1HVy\AppData\Local\Temp\Liebert.bmp - Access, Create, Write
Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Templates\spolsve.exe - Access, Create
Not Available
\??\C:\WINDOWS\SYSTEM32\ntdll.dll - Access, Create
Not Available
c:\programdata\a7963\tlworker.exe‡kk”v–p¤j0“8q - Access, Create
Not Available
Registry (45)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Access, Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access, Create
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
Domain (1)
»
Domain Sources Severity
www.rabadaun.com PCAP, Function Log
Unknown
URL (2)
»
URL Operations Category Severity
http://186.122.150.107/cc/index.php POST Contacted
Blacklisted
https://www.rabadaun.com/wordpress/wp-content/themes/TEMP.so get Contacted
Unknown
IP (2)
»
IP Protocols Sources
134.0.11.201 TCP, DNS, HTTPS PCAP, Function Log
186.122.150.107 TCP, HTTP, DNS PCAP, Function Log
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image