Overview

overview

8

Static

static

IMG_2021_0...38.doc

windows7_x64

8

IMG_2021_0...38.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IMG_2021_01_13_1_RFQ_PO_1832938.doc

  • Size

    649KB

  • Sample

    210113-z2vq7lgkas

  • MD5

    1c06c113c56f4259142267c6a7184892

  • SHA1

    5cabd7667c21515c17510c1b788b4739302d35c8

  • SHA256

    261929831b3f6a8abe7966a39b7b9313373fb355a342dc93fceb222aea5138a4

  • SHA512

    6a6e60f32eb83360c83c8dcaa593ab1d20bf1dee80ffff69a91821fdf8b6812d91ea5ca006116163d15271ec50766368cb553202ac4cfedb5f7c561b67989441

Score
8/10

Malware Config

Targets

    • Target

      IMG_2021_01_13_1_RFQ_PO_1832938.doc

    • Size

      649KB

    • MD5

      1c06c113c56f4259142267c6a7184892

    • SHA1

      5cabd7667c21515c17510c1b788b4739302d35c8

    • SHA256

      261929831b3f6a8abe7966a39b7b9313373fb355a342dc93fceb222aea5138a4

    • SHA512

      6a6e60f32eb83360c83c8dcaa593ab1d20bf1dee80ffff69a91821fdf8b6812d91ea5ca006116163d15271ec50766368cb553202ac4cfedb5f7c561b67989441

    Score
    8/10

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks