Overview

overview

10

Static

static

8

05504-122020.doc

windows7_x64

10

05504-122020.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05504-122020.doc

  • Size

    208KB

  • Sample

    210309-hkndb1zras

  • MD5

    129154ace2845c087bbd66916306f1fb

  • SHA1

    65b731e5b97c63e59c03d2571de02414d4912eeb

  • SHA256

    effe6ed0eaae43f9ab347679a9abfe647cc606e64c1f742259f8ddc73f58923a

  • SHA512

    6616267e59fb1fb124b032b800b54d664ed44d8cdcd1ab3851d3fb90746e6264aee748956badbc0327a3b4f05b03c52c7331c9a1a1b7681443037f3273cdfd4a

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://anjumanclick.com/q/kvM/
exe.dropper

https://duocnhanhoa.com/wp-admin/J5JbVEY/
exe.dropper

https://yellomosquito.com/wp-includes/w/
exe.dropper

https://thaithienson.net/wp-admin/EksZXO/
exe.dropper

http://penambahberatbadan.info/r/pXPKwJ/
exe.dropper

https://thienloc.org/data-sgp-kgfig/AaK/
exe.dropper

https://ecomdemo2.ogsdev.net/wp-content/zWWB/

Targets

    • Target

      05504-122020.doc

    • Size

      208KB

    • MD5

      129154ace2845c087bbd66916306f1fb

    • SHA1

      65b731e5b97c63e59c03d2571de02414d4912eeb

    • SHA256

      effe6ed0eaae43f9ab347679a9abfe647cc606e64c1f742259f8ddc73f58923a

    • SHA512

      6616267e59fb1fb124b032b800b54d664ed44d8cdcd1ab3851d3fb90746e6264aee748956badbc0327a3b4f05b03c52c7331c9a1a1b7681443037f3273cdfd4a

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks