Overview

overview

10

Static

static

8

SecuriteIn...36.xls

windows7_x64

6

SecuriteIn...36.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.DOC.Kryptik.Q.17436

  • Size

    303KB

  • Sample

    200713-z71l41lk12

  • MD5

    50d833a21db581f09239c26b5723376b

  • SHA1

    d11f201a327d253cc68836e39ca73ece51f2767b

  • SHA256

    6e650a4383b6094da81c5d909ea099d520b969348e7189d6b04b6cb5dffdf754

  • SHA512

    9f9be8e4688ae30360b5bcf50fc1307a569cc1cfdea443708c7a795b8bd4285a3c989ed7f2d773aef7647680f22f0f4e41fb346c552bb084dab2f0801e1885c7

Score
10/10
macro

Malware Config

Targets

    • Target

      SecuriteInfo.com.DOC.Kryptik.Q.17436

    • Size

      303KB

    • MD5

      50d833a21db581f09239c26b5723376b

    • SHA1

      d11f201a327d253cc68836e39ca73ece51f2767b

    • SHA256

      6e650a4383b6094da81c5d909ea099d520b969348e7189d6b04b6cb5dffdf754

    • SHA512

      9f9be8e4688ae30360b5bcf50fc1307a569cc1cfdea443708c7a795b8bd4285a3c989ed7f2d773aef7647680f22f0f4e41fb346c552bb084dab2f0801e1885c7

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Enumerates connected drives

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks