MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fccad2fea7371ad24a1256b78165bceffc5d01a850f6e2ff576a2d8801ef94fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Maldoc score: 5


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fccad2fea7371ad24a1256b78165bceffc5d01a850f6e2ff576a2d8801ef94fa
SHA3-384 hash: d6f69eac3801980782ed264d3b935839d4d11fb2947921235973171fd3659f7fec9c72e7cd3ae64023cf38b516678eac
SHA1 hash: 224fe06d61d2dc8d273a41d6dd83c9ce378719b9
MD5 hash: ce866ae254de4cabd60a95abcc52c315
humanhash: fanta-autumn-princess-blue
File name:ce866ae254de4cabd60a95abcc52c315.doc
Download: download sample
File size:895'425 bytes
First seen:2021-08-30 13:35:04 UTC
Last seen:2021-08-30 13:37:24 UTC
File type:Word file doc
MIME type:application/msword
ssdeep 3072:1uPDUFXkzvSSoEMXO6TYeI+ehGpYQXyCpG4yWuQOGUjGsZNF+4sM02q92b6IcNUZ:s4GTSSozXO68eI+ZpGWubGsh8XX24Nj0
TLSH T187154605BA1FFBF3C1ABC5303FEB4B4D4C861976C7D6665622A71E0A22D182C17C5BA4
Reporter JAMESWT_WT
Tags:doc KONNI

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 5
Application name is Microsoft Office Word
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 11 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
24096 bytesDocumentSummaryInformation
34096 bytesSummaryInformation
490334 bytes1Table
54096 bytesData
6443 bytesMacros/PROJECT
741 bytesMacros/PROJECTwm
81538 bytesMacros/VBA/ThisDocument
92483 bytesMacros/VBA/_VBA_PROJECT
10512 bytesMacros/VBA/dir
11772910 bytesWordDocument
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecDocument_OpenRuns when the Word or Publisher document is opened
IOCy.jsExecutable file name
SuspiciousShellMay run an executable file or a system command
SuspiciousvbHideMay run an executable file or a system command

Intelligence

File Origin
# of uploads :
3
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ce866ae254de4cabd60a95abcc52c315.doc
Verdict:
Malicious activity
Analysis date:
2021-07-30 10:42:40 UTC
Tags:
macros macros-on-open
Link:
https://app.any.run/tasks/3e7a93e5-584a-4434-9747-1f6668b319ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/msword
Has a screenshot:
False
Contains macros:
True
Detection(s):
Twinwave.EvilDoc.ActiveDocEndlessNightmare.20210802.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.blankopen.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.vbhish.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.CMDCB64A.1.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.CMDCB64A.12.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WSCRIPT.SHELL.200129B64.7.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.KERNEL32.200608B64.4.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.ACTIVEXOBJECT.210129B64.7.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.ACTIVEXOBJECT.210129B64.9.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.6.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching a process
Creating a file
Running batch commands
Sending a UDP request
Deleting a recently created file
Replacing files
Changing a file
Running batch commands by exploiting the app vulnerability
Deleting of the original file
Result
Verdict:
Malicious
File Type:
Legacy Word File with Macro
Link:
https://app.docguard.net/fccad2fea7371ad24a1256b78165bceffc5d01a850f6e2ff576a2d8801ef94fa/results/dashboard
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/841597
Signature
Bypasses PowerShell execution policy
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Suspicious Csc.exe Source File Folder
Sigma detected: WScript or CScript Dropper
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 474025 Sample: uYjgCm2C0H.doc Startdate: 30/08/2021 Architecture: WINDOWS Score: 96 72 Multi AV Scanner detection for domain / URL 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 Obfuscated command line found 2->76 78 7 other signatures 2->78 10 WINWORD.EXE 72 38 2->10         started        process3 file4 60 C:\Users\user\AppData\...\uYjgCm2C0H.doc.LNK, MS 10->60 dropped 80 Obfuscated command line found 10->80 14 cmd.exe 2 10->14         started        signatures5 process6 signatures7 82 Obfuscated command line found 14->82 17 wscript.exe 3 14->17         started        20 cmd.exe 1 14->20         started        22 conhost.exe 14->22         started        24 findstr.exe 1 14->24         started        process8 signatures9 66 Wscript starts Powershell (via cmd or directly) 17->66 68 Obfuscated command line found 17->68 70 Bypasses PowerShell execution policy 17->70 26 powershell.exe 37 17->26         started        30 cmd.exe 2 17->30         started        33 cmd.exe 2 17->33         started        35 wscript.exe 17->35         started        process10 dnsIp11 64 romanovawillkillyou.c1.biz 185.176.43.106, 49710, 80 ZETTA-ASBG Bulgaria 26->64 62 C:\Users\user\AppData\...\liagrgg5.cmdline, UTF-8 26->62 dropped 37 csc.exe 3 26->37         started        40 cmd.exe 1 26->40         started        42 cmd.exe 1 26->42         started        44 conhost.exe 26->44         started        84 Obfuscated command line found 30->84 46 conhost.exe 30->46         started        48 findstr.exe 1 30->48         started        50 conhost.exe 33->50         started        52 findstr.exe 1 33->52         started        file12 signatures13 process14 file15 58 C:\Users\user\AppData\Local\...\liagrgg5.dll, PE32 37->58 dropped 54 cvtres.exe 1 37->54         started        56 expand.exe 1 40->56         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fccad2fea7371ad24a1256b78165bceffc5d01a850f6e2ff576a2d8801ef94fa/
Threat name:
Document-Word.Dropper.SDrop
Create hunting rule
Status:
Malicious
First seen:
2021-07-30 00:07:00 UTC
File Type:
Document
Extracted files:
106
AV detection:
26 of 46 (56.52%)
Threat level:
  3/5
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro macro_on_action
Link:
https://tria.ge/reports/210830-gns9x1ggga/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in Windows directory
Blocklisted process makes network request
Process spawned unexpected child process
Malware Config
Dropper Extraction:
http://romanovawillkillyou.c1.biz/index.php?user_id=417
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fccad2fea7371ad24a1256b78165bceffc5d01a850f6e2ff576a2d8801ef94fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PowerShell_in_Word_Doc
Create hunting rule
Author:Florian Roth
Description:Detects a powershell and bypass keyword in a Word document
Reference:Internal Research - ME

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/

Comments