Additional Info:
Date of investigation: Dec, 04, 2024, 10:27 PM
Alert title: Possible MalDoc in PDF was Detected
Time to investigate: 27 minutes<\/p>\n\n\n\n
Retrospective Note:
If I were to revisit this today, I would add that I learned the file had to be user-executed and that the second executable was through the anyrun sandbox. I would add the exact query used to find the logs tied to the RAR file and include the timestamps for those actions. As well as the timestamp and URL of the site contacted. As well as noting down the paths where the malicious files were dropped.<\/p>\n\n\n\n
Affected systems and users\n\nEndpoint Address IP:172.16.17.143\nHostname: Angela\nMalicious IP: 146[.]70.45.83\n\nSteps taken in the investigation\nHash is reported as malicious by 37 vendors, according to VirusTotal. Internal threat intelligence marks the file as known malicious. Checked Anyrun, but all the reports there are labeled as non-malicious. I can see that the files had to be user-executed and that a second executable file is dropped; this executable checked for information on the system. Checked SIEM and confirmed that the .rar file was downloaded, unpacked, and executed. After execution, we can see a connection being made to a site. This site is marked as malicious by 15 vendors. \n\nArtifacts\nSupport AT impressiondigitals[.]agency\n146[.]70.45.83\ncba6bd373e42a7bcbc4c7251bc188b69\n179[.]60.147.117\nhxxp[:\/\/]web365metrics.[]com\/\n\nActions taken\nContained the system. Deleted the files from the endpoint.\n\nReferences\nhttps://www.virustotal.com\/gui\/file\/098796e1b82c199ad226bff056b6310262b132f6d06930d3c254c57bdf548187\nhttps:\/\/app.any.run\/tasks\/6a9e9ea2-836d-49cf-8ea5-946eaddfeeae\nhttps:\/\/www.virustotal.com\/gui\/ip-address\/179.60.147.117\nhttps:\/\/www.abuseipdb.com\/check\/179.60.147.117\nhttps:\/\/www.virustotal.com\/gui\/url\/91f63156aca5cf7a80d131ba0e5cc288acf9001abc6c6d20d814c792f566b530\/detection\nhttps:\/\/www.virustotal.com\/gui\/ip-address\/146.70.45.83\nhttps:\/\/www.abuseipdb.com\/check\/146.70.45.83\nhttps:\/\/www.virustotal.com\/gui\/domain\/impressiondigitals.agency\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Additional Info:Date of investigation: Dec, 04, 2024, 10:27 PMAlert title: Possible MalDoc in PDF was DetectedTime to investigate: 27 minutes Retrospective Note:If I were to revisit this today, I would add that I learned the file had to be user-executed and that the second executable was through the anyrun sandbox. I would add the exact query used to find the logs tied to the RAR file and include the timestamps for those actions. As well as the timestamp and URL of the site contacted. As well as noting down the paths where the malicious files were dropped.<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"class_list":["post-1184","page","type-page","status-publish","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t