Overview

overview

8

Static

static

SwiftRef_I...0.xlsx

windows7_x64

8

SwiftRef_I...0.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SwiftRef_INV0880021122020.xlsx

  • Size

    2.1MB

  • Sample

    210114-s4x8nnvq12

  • MD5

    718d82225f395451cdb526415d0c731d

  • SHA1

    1b5f38031a9c79b619ca55da7acfcea8f777b68b

  • SHA256

    f248734ac37efc2acdef5a28ed576e47ac294a99183173fab722bb45a65ddc6e

  • SHA512

    46b72ea1fd547910fa6c3643cfaf3d918427eb9218157212f0b203730fc6c08beb340e02bb6daabfdb06ac9414891dfdeeca28dc0ca4c72d451b2f979fd7382c

Score
8/10

Malware Config

Targets

    • Target

      SwiftRef_INV0880021122020.xlsx

    • Size

      2.1MB

    • MD5

      718d82225f395451cdb526415d0c731d

    • SHA1

      1b5f38031a9c79b619ca55da7acfcea8f777b68b

    • SHA256

      f248734ac37efc2acdef5a28ed576e47ac294a99183173fab722bb45a65ddc6e

    • SHA512

      46b72ea1fd547910fa6c3643cfaf3d918427eb9218157212f0b203730fc6c08beb340e02bb6daabfdb06ac9414891dfdeeca28dc0ca4c72d451b2f979fd7382c

    Score
    8/10

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks