Overview

overview

10

Static

static

8

SecuriteIn...95.xls

windows7_x64

6

SecuriteIn...95.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.DOC.Kryptik.Q.13895

  • Size

    293KB

  • Sample

    200713-r3wj13ng4a

  • MD5

    a402ee26ec56afffa6f638b9cfa2e646

  • SHA1

    f4db2a82f5dad24e4a6260e463b4ce7fbb37c802

  • SHA256

    da21cec62d9b7cf3e162b4e6a6e8d29262280e57f423860a8052c4512304186f

  • SHA512

    a6221a2e19e1d9f95942e07410c1f3aca181d28dfb51e60f7c19f9eff3977ada2bb3e3ec892c4c2271854a3d750ffb58c8eb6f6a5f30e5af4e40c03e80a11759

Score
10/10
macro

Malware Config

Targets

    • Target

      SecuriteInfo.com.DOC.Kryptik.Q.13895

    • Size

      293KB

    • MD5

      a402ee26ec56afffa6f638b9cfa2e646

    • SHA1

      f4db2a82f5dad24e4a6260e463b4ce7fbb37c802

    • SHA256

      da21cec62d9b7cf3e162b4e6a6e8d29262280e57f423860a8052c4512304186f

    • SHA512

      a6221a2e19e1d9f95942e07410c1f3aca181d28dfb51e60f7c19f9eff3977ada2bb3e3ec892c4c2271854a3d750ffb58c8eb6f6a5f30e5af4e40c03e80a11759

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Enumerates connected drives

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks