Overview

overview

10

Static

static

8

Patent_656...20.doc

windows7_x64

10

Patent_656...20.doc

windows10_x64

10

Resubmissions

20-11-2020 19:03

201120-cx5fwpl1we 10

20-11-2020 18:56

201120-qq16sh22ka 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Patent_656419797_as-of-27thJune2020.doc.zip

  • Size

    964KB

  • Sample

    201120-cx5fwpl1we

  • MD5

    f62a1362efee1d9ef7731d4439e46feb

  • SHA1

    db74a7834a49612a9cc5e37087757f914cf61fc7

  • SHA256

    c3a59ff2bf7e39ce991568f3a1f159dcd10bc1f10312214397b73d2978f3ff9b

  • SHA512

    1c717650942e9d9d66ac5cf3833dc569553acd21b28ac566a1cccd72ee5c1cddb5a0268bccef68712a1a84a7165715963c987545b562f3d969c332c45644c8e0

Score
10/10
macro

Malware Config

Targets

    • Target

      Patent_656419797_as-of-27thJune2020.doc

    • Size

      1006KB

    • MD5

      45df50ea19045aa1d48ee962246c8c56

    • SHA1

      86d00261ba88265bdd6b27ca76c44e2769c5088e

    • SHA256

      cf577313173f345525aff5b7efe4c709507da92a9c9211559f6ff6af00db44b2

    • SHA512

      262d148ed613ad6659c9f186537a50c8228182c58616de8b03687389ade4541e2cb829eee99a86b89c69af7e4d854e38813a030b528cb83f1fdefca96beb9bf4

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks