SHARE
TWEET

#OfflRouter_211019

VRad Oct 23rd, 2019 (edited) 170 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #IOC #OptiData #VR #OfflRouter #W97M #AutoOpen #macroworm #spreadbyanydoc
  2.  
  3. https://pastebin.com/mwt1seDE
  4.  
  5. previous_contact:
  6. https://radetskiy.wordpress.com/2018/03/23/ioc_vba_d0c_worm_140318/
  7.  
  8. FAQ:
  9. https://mobile.twitter.com/malwrhunterteam/status/999722052029501440
  10. https://twitter.com/malwrhunterteam/status/999730366561865728/
  11. https://www.csirt.gov.sk/aktualne-7d7.html?id=151
  12.  
  13. attack_vector
  14. --------------
  15. email attach .DOC > macro > Users\Public\ctrlpanel.exe
  16.  
  17. email_headers
  18. --------------
  19. n/a
  20.  
  21. files
  22. --------------
  23. SHA-256     -NDA-
  24. File name   -NDA-.doc (initial infected doc)    [Microsoft Word 2007+]
  25. File size   116.32 KB (119111 bytes)
  26.  
  27. SHA-256     10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8
  28. File name   ctrlpanel.exe       [PE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly]
  29. File size   34.5 KB (35328 bytes)
  30.  
  31. activity
  32. **************
  33. PL_SCR  - inside infected docm file        
  34.  
  35. C2  - no ntwrk activity
  36.  
  37. netwrk
  38. --------------
  39. n/a - no ntwrk activity
  40.  
  41. comp
  42. --------------
  43. n/a - no ntwrk activity
  44.  
  45. proc
  46. --------------
  47. "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\operator\Desktop\-NDA-.doc" /o "u"
  48. c:\Users\Public\ctrlpanel.exe
  49.  
  50. [another thread]
  51.  
  52. C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  53. "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
  54.  
  55. -cycle-
  56. search all .doc files
  57. copy .doc to %temp%
  58. inject macros and ctrlpanel.exe in %temp%
  59. overwrite original files
  60.  
  61. persist
  62. --------------
  63. under_user - no persist
  64.  
  65. under_admin - broken persist by reg:
  66.  
  67. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run              22.10.2019 17:43  
  68. Ctrlpanel           File not found: c:\Users\Public.exe    
  69. c:\Users\Public
  70.  
  71. drop
  72. --------------
  73. c:\Users\Public\ctrlpanel.exe
  74. %temp%\*.doc        - all DOC`s are injected
  75.  
  76. # # #
  77.  
  78. https://www.virustotal.com/gui/file/10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8/details
  79. https://analyze.intezer.com/#/analyses/509b542f-dd0e-4042-8e29-ea8c9dcddb09
  80.  
  81. VR
  82.  
  83. @
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top