Overview

overview

10

Static

static

10

Booking Co...n.docx

windows7_x64

7

Booking Co...n.docx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Booking Confirmation.docx

  • Size

    10KB

  • Sample

    210519-j2jencl8ys

  • MD5

    5e61d2df75f9079d220b8bbb7e42460f

  • SHA1

    1a94058d521306731f72ae81b780f22c51692897

  • SHA256

    d7180388cdbb45464fe8a11fc9cec87efea24d93ec8c32e1edc787120b92cc08

  • SHA512

    c64a3bc47bc7ed9178b0cd66552d12d4d5c174664a996fa53d02755a7e09c189edab1e3247b3980940efe7128a84a0b650724460e5bffe520b0530c8d6338e1d

Score
10/10
websettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

https://zamadladlapsychology.co.za/bin/o.wbk

Targets

    • Target

      Booking Confirmation.docx

    • Size

      10KB

    • MD5

      5e61d2df75f9079d220b8bbb7e42460f

    • SHA1

      1a94058d521306731f72ae81b780f22c51692897

    • SHA256

      d7180388cdbb45464fe8a11fc9cec87efea24d93ec8c32e1edc787120b92cc08

    • SHA512

      c64a3bc47bc7ed9178b0cd66552d12d4d5c174664a996fa53d02755a7e09c189edab1e3247b3980940efe7128a84a0b650724460e5bffe520b0530c8d6338e1d

    Score
    7/10

    • Abuses OpenXML format to download file from external location

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks