SOC137 EventID:76 - Malicious File/Script Download Attempt
Analysis of a malicious file download.
Severity: Medium
A malicious download was attempted from NicolasPRD but the action was blocked. The user NicolasPRD had not logged in since Mar, 07, 2021, 04:30 PM (figure 2). This security event occurred Mar, 14, 2021, 07:15 PM (figure 1).
Figure 1 Details of the alert
Figure 2 Endpoint information on the host
I uploaded the document into Hybrid analysis (figure 4) and Virus Total (figure 3), and both determined the file was malicious. The file was uploaded into Any.run, it was determined to be malicious and also contain macros (figure 5).
Figure 3 Virus Total analysis on suspicious word document
Considering this, the threat actor may have spoofed the IP address to gain access to the network and attempted to download the malicious word document. I downloaded the zipped file on a windows 20 flare-vm, and unzipped it revealing the INVOICE PACKAGE LINK TO DOWNLOAD.docm file.
Figure 4 Hybrid Analysis, analysis overview of suspicious document
Figure 5 Any.Run analysis of the suspicious document
When the word document is opened from the temp folder, it initiates a powershell command which downloads a file from filetransfer.io, a malicious domain (figure 6). Furthermore, there were changes to registry keys associated with Microsoft office and Windows installer. Additionally, temporary files were created in the user’s AppData directory by Microsoft word and powershell processes which could be malicious activity.
Figure 6 Indicators of compromises
Figure 7 Potential threats associated with the malware
Conclusion
In conclusion, a medium alert receieve on March 14th 2021, for the attempted download of a Word document. The action was successfully blocked. The document was uploaded to multiple analyzers and was found to be malicious. Opening the suspicious file resulted in the downloading of a file via PowerShell from filetransfer.io. After the file was executed registry keys were modified and the temporary files were created in specific directories. These suspicious activities could be indicative of malicious behavior, warranting further investigation by a malware analyst to understand the full scope of the potential threat.