Overview

overview

10

Static

static

8

DATI_2020.doc

windows7_x64

10

DATI_2020.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DATI_2020.doc
  • Size 191KB
  • Sample201221-27fmatntz6
  • SHA256 40262cc016ac77ac410894f3dfd8a1c4a3fcbb3725a583d6defd2ea4d556df5a
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://parakkunnathtemple.com/bckup/7SDAvi/
  • exe.dropper

    http://helionspharmaceutical.com/wp-admin/oXJB/
  • exe.dropper

    https://accordiblehr.com/wp-admin/HdzyEn/
  • exe.dropper

    https://snjwellers.com/wp-includes/esttW/
  • exe.dropper

    https://norailya.com/vendor/1j/
  • exe.dropper

    https://whytech.info/wp-includes/HceUxFK/
  • exe.dropper

    http://resuco.net/wp-content/uploads/2020/12/S0K/

Targets

    • Target
      DATI_2020.doc
    • Size 191KB
    • SHA256 40262cc016ac77ac410894f3dfd8a1c4a3fcbb3725a583d6defd2ea4d556df5a
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks