Overview

overview

10

Static

static

inv_159753.doc

windows7_x64

10

inv_159753.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    inv_159753.doc.zip

  • Size

    55KB

  • Sample

    200214-45p2fs8tss

  • MD5

    04e8788fe63089a8b94cb33bdbe38c3d

  • SHA1

    897757da9bf7c499498cc80f8db37c374db7caf7

  • SHA256

    a91b0032cb0e8810badd25042baae0ae02e97e3b2e2529048a153839423ab455

  • SHA512

    12c6d2a382ad3f032aef5ecbe42f559f14762c5e52fc51885281f87d90cc0dd79b5a227d778b343f99f3585cddd32cfab00e2b0b3b18e3029eb75f166d45e298

Score
10/10

Malware Config

Targets

    • Target

      inv_159753.doc

    • Size

      69KB

    • MD5

      6d749ffcd2401156495472cc5a80e981

    • SHA1

      f2b4c2a55a9c1783ecef638bebe487f22b5c57d7

    • SHA256

      73eb9a15992e9821c086ef783fb98092cad0784ae6a9b8b678ad4c879b3e194a

    • SHA512

      d0b7c2e22dcde3423df6a86e643366228349fc9644b6287f7748814f8bb8f5eb39604f350d07f492d953879fbe0b0fb848483b02efbb8d2e678b75b72ef11276

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks