Overview

overview

10

Static

static

deed contr...20.doc

windows7_x64

10

deed contr...20.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    deed contract.11.20.doc

  • Size

    143KB

  • Sample

    201124-ess7e2rmle

  • MD5

    98ec9df6254d78b1fc1abdf7090da3f7

  • SHA1

    6642cb5d474a9ed788fb5a33cc5b72c6f825c1f3

  • SHA256

    37db367c01e40ee2f05a5966d6670e07fd3292c01f4da8ffd77c0e3c96a79464

  • SHA512

    dfbc5ff2b935b905ad554b30994dc0446d93e0d8eaeb279ab33c376b35ff1cad6b21931da920c103ab435ac1c2968bcfcc8c3e0db2c3ae2222f5b86ab0460354

Score
10/10

Malware Config

Targets

    • Target

      deed contract.11.20.doc

    • Size

      143KB

    • MD5

      98ec9df6254d78b1fc1abdf7090da3f7

    • SHA1

      6642cb5d474a9ed788fb5a33cc5b72c6f825c1f3

    • SHA256

      37db367c01e40ee2f05a5966d6670e07fd3292c01f4da8ffd77c0e3c96a79464

    • SHA512

      dfbc5ff2b935b905ad554b30994dc0446d93e0d8eaeb279ab33c376b35ff1cad6b21931da920c103ab435ac1c2968bcfcc8c3e0db2c3ae2222f5b86ab0460354

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks