Overview

overview

10

Static

static

8

ORDINE 2021004.doc

windows7_x64

10

ORDINE 2021004.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDINE 2021004.doc

  • Size

    196KB

  • Sample

    210306-7373r6erf6

  • MD5

    797f651c45b0b81311e0e23844a448e2

  • SHA1

    2bfaa69508304632718274c6a648cf28f0199bd3

  • SHA256

    3fcb2dde6e1867fdbb5b6d5d9ed05a486b69855df4438dce4f4313f454effaf2

  • SHA512

    61873f8c6e9fe9a67667fef1f57d60a25a5cae7f7df372a2f099849f764bc55361909c52f2cb62de9776350f7566b13f661d80cf350eb71b751bdefa4c815e68

Score
10/10
macromacro_on_actionxlm

Malware Config

Targets

    • Target

      ORDINE 2021004.doc

    • Size

      196KB

    • MD5

      797f651c45b0b81311e0e23844a448e2

    • SHA1

      2bfaa69508304632718274c6a648cf28f0199bd3

    • SHA256

      3fcb2dde6e1867fdbb5b6d5d9ed05a486b69855df4438dce4f4313f454effaf2

    • SHA512

      61873f8c6e9fe9a67667fef1f57d60a25a5cae7f7df372a2f099849f764bc55361909c52f2cb62de9776350f7566b13f661d80cf350eb71b751bdefa4c815e68

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks