Brendan received a phishing email from support[@]appofficedrive[.]com carrying setup[.]zip, flagged on VirusTotal as a trojan. He extracted it with 7-Zip and ran setup[.]ps1, which did host recon, pulled a password protected second stage from AWS S3, extracted it and executed denis[.]exe. Sysmon EID 1 confirms execution and network logs show C2 traffic to two IPs. Host isolated.
setup[.]zipsetup[.]ps1nslookup outlook[.]officebetas[.]com, ipconfig, ipconfig /all, systeminfo, local Users and Administrators group enumerationdenis[.]zip from hxxps://files-ld[.]s3[.]us-east-2[.]amazonaws[.]com/denis[.]zip to DownloadsDownloads\denis, extracts with 7z[.]exe using password infecteddenis[.]exe157[.]240[.]238[.]174 and 157[.]240[.]238[.]35| ID | Tactic | Technique |
|---|---|---|
| T1566.001 | Initial Access | Spearphishing Attachment |
| T1204.002 | Execution | Malicious File |
| T1059.001 | Execution | PowerShell |
| T1016 | Discovery | System Network Configuration Discovery |
| T1082 | Discovery | System Information Discovery |
| T1069.001 | Discovery | Local Groups |
| T1105 | Command and Control | Ingress Tool Transfer |
| T1027.013 | Defense Evasion | Encrypted/Encoded File |
| T1140 | Defense Evasion | Deobfuscate/Decode Files or Information |
| T1071 | Command and Control | Application Layer Protocol |
| Type | Value |
|---|---|
| Sender | support[@]appofficedrive[.]com |
| SHA256 (setup.zip) | 4fe987b600781253951c298361c8175923f7ce3386c38057e326e6ff244557e6 |
| Script | setup[.]ps1 |
| Second stage | denis[.]zip / denis[.]exe |
| URL | hxxps://files-ld[.]s3[.]us-east-2[.]amazonaws[.]com/denis[.]zip |
| Domain | outlook[.]officebetas[.]com |
| C2 IP | 157[.]240[.]238[.]174 |
| C2 IP | 157[.]240[.]238[.]35 |
| Archive password | infected |
appofficedrive[.]comdenis[.]exe and C2 connections across the estateTrue Positive. Malware executed, C2 established. Escalated.