Overview

overview

10

Static

static

8

dati_12_2021.doc

windows7_x64

10

dati_12_2021.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dati_12_2021.doc

  • Size

    162KB

  • Sample

    210113-p7vfsk1gx2

  • MD5

    16c6a20e9886d7d0967ad6fd3c37a34b

  • SHA1

    057a70580057da08a7c33557675dee7ac92e3067

  • SHA256

    5011b9d3918375637478cd90e8c64ca597910b7d6a76042e06527b77886c43e7

  • SHA512

    ca69decb5a7331d5cb679688ba3c38358d8b7363f8aed468234cfaf9a900b64cdad8da0bf04eabd95d5f0372b1bfa970bd09bdd5aa15e0ac5778d36a6c0fbd3b

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.mitraship.com/wp-content/ZKeB/
exe.dropper

http://djsrecord.com/wp-includes/abop/
exe.dropper

https://lastfrontierstrekking.com/new/2OaabFU/
exe.dropper

https://watchnshirt.com/y/L7z9YcA/
exe.dropper

https://www.impipower.com/wp-content/U/
exe.dropper

https://www.inkayniperutours.com/druver/LtcG/
exe.dropper

https://vysimopoulos.com/d/NF/

Targets

    • Target

      dati_12_2021.doc

    • Size

      162KB

    • MD5

      16c6a20e9886d7d0967ad6fd3c37a34b

    • SHA1

      057a70580057da08a7c33557675dee7ac92e3067

    • SHA256

      5011b9d3918375637478cd90e8c64ca597910b7d6a76042e06527b77886c43e7

    • SHA512

      ca69decb5a7331d5cb679688ba3c38358d8b7363f8aed468234cfaf9a900b64cdad8da0bf04eabd95d5f0372b1bfa970bd09bdd5aa15e0ac5778d36a6c0fbd3b

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks