Macro-less Word Doc. uses DDE to Execute Powershell, Download DLL
Try VMRay Analyzer
|
VTI Score
100 / 100
|
|
| VTI Database Version | 2.6 |
| VTI Rule Match Count | 30 |
| VTI Rule Type | Documents |
|
File System |
|
|
|
Modify operating system directory
|
|
|
Create file "C:\Windows\system32\sensr9.dat" in the OS directory.
|
||
|
Create file "C:\Windows\system32\ikeext32.dll" in the OS directory.
|
||
|
Create file "C:\Windows\system32\sensr3.dat" in the OS directory.
|
||
|
Create file "C:\Windows\system32\ikeext.dll" in the OS directory.
|
||
|
Modify file "C:\Windows\system32\sensr3.dat" in the OS directory.
|
||
|
Modify file "C:\Windows\system32\ikeext.dll" in the OS directory.
|
||
|
Modify file "C:\Windows\system32\sensr9.dat" in the OS directory.
|
||
|
|
Network |
|
|
|
Download data
|
|
|
URL "213.183.51.187/debug.dll".
|
||
|
|
Perform DNS request
|
|
|
Resolve host name "127.0.0.1".
|
||
|
|
Connect to remote host
|
|
|
Outgoing TCP connection to host "213.183.51.187:80".
|
||
|
|
Connect to HTTP server
|
|
|
URL "213.183.51.187/debug.dll".
|
||
|
|
PE |
|
|
|
Drop PE file
|
|
|
Drop file "c:\users\bgc6u8oy yxgxkr\appdata\local\tempdebug.dll".
|
||
|
Drop file "c:\windows\system32\ikeext.dll".
|
||
|
Drop file "c:\windows\system32\ikeext32.dll".
|
||
|
|
Process |
|
|
|
Create process
|
|
|
Create process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe".
|
||
|
Create process ""C:\Windows\system32\rundll32.exe" C:\Users\BGC6U8~1\AppData\Local\Tempdebug.dll HOK".
|
||
|
Create process "C:\Windows\system32\cmd.exe /c "net stop /y ikeext"".
|
||
|
Create process "C:\Windows\system32\net.exe".
|
||
|
Create process "C:\Windows\system32\cmd.exe /c "takeown /F C:\Windows\system32\ikeext.dll"".
|
||
|
Create process "C:\Windows\system32\takeown.exe".
|
||
|
Create process "C:\Windows\system32\cmd.exe /c "icacls C:\Windows\system32\ikeext.dll /grant system:F"".
|
||
|
Create process "C:\Windows\system32\icacls.exe".
|
||
|
Create process "C:\Windows\system32\cmd.exe /c "icacls C:\Windows\system32\ikeext.dll /grant administrators:F"".
|
||
|
Create process "C:\Windows\system32\cmd.exe /c "sc config ikeext start= auto"".
|
||
|
Create process "C:\Windows\system32\sc.exe".
|
||
|
Create process "C:\Windows\system32\cmd.exe /c "net start ikeext"".
|
||
|
Create process "C:\Users\BGC6U8~1\AppData\Local\Temp\iun4816.bat".
|
||
|
Create process "C:\Windows\system32\attrib.exe".
|
||
|
Create process "C:\Windows\system32\PING.EXE".
|
||
|
Create process "C:\Windows\system32\cmd.exe".
|
||
|
|
Create system object
|
|
|
Create mutex with name "Global\.net clr networking".
|
||
| - | Anti Analysis | |
| - | Browser | |
| - | Device | |
| - | OS | |
| - | Hide Tracks | |
| - | Information Stealing | |
| - | Injection | |
| - | Kernel | |
| - | Masquerade | |
| - | Persistence | |
| - | User | |
| - | VBA Macro | |
| - | YARA | |
