🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 10


Maldoc score: 11


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1
SHA3-384 hash: f0bdf2812abc0b107565cd2288ae154ccaac64390204575bc12e80cfc99c3b18b9a6071799844a7baf24014f4f9ae5e6
SHA1 hash: e22eba09526ab2e7298b533cbd71b2939edded10
MD5 hash: f2a9bc0e23f6ad044cb7c835826fa8fe
humanhash: four-lima-bravo-illinois
File name:fgi5k8.dotm
Download: download sample
Signature LockBit
Create hunting rule
File size:16'546 bytes
First seen:2024-01-15 14:13:08 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 384:tXepRtEkZgNJZ9INxt/ZtNNjdFwFIixKkBbN:VETXZgNcxllNAFFxfj
TLSH T1CB729E7DDA05B408E7B2867DC19D08FDF12C8212D615A6AB3C41D28F9A60DEB1317BCE
TrID 53.0% (.DOCM) Word Microsoft Office Open XML Format document (with Macro) (52000/1/9)
23.9% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4)
17.8% (.ZIP) Open Packaging Conventions container (17500/1/4)
4.0% (.ZIP) ZIP compressed archive (4000/1)
1.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter JAMESWT_WT
Tags:doc learndash-825testsites-com lockbit

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
OLE dump

MalwareBazaar was able to identify 6 sections in this file using oledump:

Section IDSection sizeSection name
A1365 bytesPROJECT
A241 bytesPROJECTwm
A32189 bytesVBA/ThisDocument
A42530 bytesVBA/_VBA_PROJECT
A5469 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecDocument_OpenRuns when the Word or Publisher document is opened
IOCcw3fd.exeExecutable file name
SuspiciousGetObjectMay get an OLE object with a running instance
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousexecMay run an executable file or a system
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'517
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.GOStringGamesBangBang.20200908.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ICEDIDOGORiginalGangsterGOMethodsM1.20200923.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.HTTPS
Create hunting rule

TwinWave.EvilDoc.CMDObfusGamesCarrotAndStick.M1.20220128.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Word File with Macro
Link:
https://app.docguard.net/1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd macros macros-on-open masquerade packed powershell
Link:
https://www.filescan.io/uploads/65a53daa99da41ccd7d4535f/reports/1ebd9b2c-8eb6-404b-9286-3e7ea32fcd05/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1
Label:
Malicious
Suspicious Score:
8.1/10
Score Malicious:
82%
Score Benign:
18%
Link:
https://www.malware.ai/gui/files/?id=ee3ab67a-86fd-4668-a1d8-1357c2164738
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1374790
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Document contains an embedded VBA macro which may execute processes
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Installs new ROOT certificates
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell drops PE file
Yara detected LockBit ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1374790 Sample: fgi5k8.dotm.doc Startdate: 15/01/2024 Architecture: WINDOWS Score: 100 58 learndash.825testsites.com 2->58 62 Multi AV Scanner detection for domain / URL 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Antivirus detection for URL or domain 2->66 68 7 other signatures 2->68 9 WINWORD.EXE 19 18 2->9         started        signatures3 process4 signatures5 80 Obfuscated command line found 9->80 12 cmd.exe 9->12         started        14 cmd.exe 9->14         started        16 cmd.exe 9->16         started        18 35 other processes 9->18 process6 process7 20 powershell.exe 12 5 12->20         started        25 powershell.exe 14->25         started        27 powershell.exe 16->27         started        29 powershell.exe 18->29         started        31 powershell.exe 18->31         started        33 powershell.exe 18->33         started        35 32 other processes 18->35 dnsIp8 60 learndash.825testsites.com 68.66.200.213, 443, 49161, 49162 A2HOSTINGUS United States 20->60 56 C:\Users\Public\cw3fd.exe, PE32 20->56 dropped 74 Installs new ROOT certificates 20->74 76 Drops PE files to the user root directory 20->76 78 Powershell drops PE file 20->78 37 cw3fd.exe 20->37         started        40 cw3fd.exe 25->40         started        42 cw3fd.exe 27->42         started        44 cw3fd.exe 29->44         started        46 cw3fd.exe 31->46         started        48 cw3fd.exe 33->48         started        50 cw3fd.exe 35->50         started        52 cw3fd.exe 35->52         started        54 29 other processes 35->54 file9 signatures10 process11 signatures12 70 Multi AV Scanner detection for dropped file 37->70 72 Contains functionality to detect hardware virtualization (CPUID execution measurement) 37->72
Score:
0%
Verdict:
Benign
File Type:
DOC
Link:
https://malprob.io/report/1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-01-08 07:50:00 UTC
File Type:
Document
Extracted files:
20
AV detection:
15 of 23 (65.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dwo5y6cq7wkfduwf2xh62fw6kffil6ppfbked7st73cozsm7kdqq._file
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit ransomware
Link:
https://tria.ge/reports/240115-rjzd7sabg2/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Control Panel
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Program crash
Drops file in Windows directory
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops desktop.ini file(s)
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
Renames multiple (146) files with added filename extension
Lockbit
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LockBit

Word file doc 1d9ddc7850fd9451d2c5d5cfed16de514a85f9ef285441fe53fec4ecc99f50e1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2748879/
  
Delivery method
Distributed via web download

Comments