Overview

overview

10

Static

static

8

RechnungSc...20.doc

windows7_x64

10

RechnungSc...20.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RechnungScan_14_10_2020.doc
  • Size 133KB
  • Sample201014-9cj9r53smn
  • SHA256 0b7c68b124d59eae70ae939bc6b4ea796c544dedf331efe54fdf582a15efe006
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://riandutra.com/img/YX1/
  • exe.dropper

    http://swimsecure.com/vsim-henry/r/
  • exe.dropper

    http://guarany.net/zefiro/ZO/
  • exe.dropper

    https://losgalpones.com/wp-admin/T/
  • exe.dropper

    https://qualitychildcarepreschool.com/0Bq0iCR6gx/oq/
  • exe.dropper

    https://businessexitnow.com/old-wp-includes/1yr/
  • exe.dropper

    https://brownshotelgroup.com/hotelbrownsboutique.com/2r/

Targets

    • Target
      RechnungScan_14_10_2020.doc
    • Size 133KB
    • SHA256 0b7c68b124d59eae70ae939bc6b4ea796c544dedf331efe54fdf582a15efe006
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks