Overview

overview

10

Static

static

8

input 05.07.2021.doc

windows7_x64

10

input 05.07.2021.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    input 05.07.2021.doc

  • Size

    79KB

  • Sample

    210509-cykww1eana

  • MD5

    3951dd7af5f15dcaf0544089adb9c260

  • SHA1

    f02a3bb9c1c9cb99b6d9995e981dc37adda8d7a2

  • SHA256

    f69cef31cd670e8cabc1d1ebf38547f91b5ba5c155dc03b82de5ef1b9adc7a10

  • SHA512

    68c27dc4496118a8d776c3591abf5d89b97ed915e1af6648fce879b68a06552fce559314f905e616b52495af110ce7459011e1ee22ff3368dac1346b43e530a1

Score
10/10
macro

Malware Config

Targets

    • Target

      input 05.07.2021.doc

    • Size

      79KB

    • MD5

      3951dd7af5f15dcaf0544089adb9c260

    • SHA1

      f02a3bb9c1c9cb99b6d9995e981dc37adda8d7a2

    • SHA256

      f69cef31cd670e8cabc1d1ebf38547f91b5ba5c155dc03b82de5ef1b9adc7a10

    • SHA512

      68c27dc4496118a8d776c3591abf5d89b97ed915e1af6648fce879b68a06552fce559314f905e616b52495af110ce7459011e1ee22ff3368dac1346b43e530a1

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks