Overview

overview

10

Static

static

10

RFQ 20210520.docx

windows7_x64

7

RFQ 20210520.docx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ 20210520.docx

  • Size

    10KB

  • Sample

    210521-sz5dcsz57a

  • MD5

    1005c900d1989543f01c87cc34b95986

  • SHA1

    99933ef28b579e9f5db2de17918653c702eab028

  • SHA256

    94db48bcbf4f8f531cb684207c78bd2cfa734317530994d08b9389c64ea5dc40

  • SHA512

    10e8b3a9d518cd689b0f7b65d95c3781301dd22eb6db092d767cbcb678c43bc26b5c006331d2c257e61836d1a992cc8044e222ab0a1003abdf7cb065afbfb4c2

Score
10/10
websettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

https://cutt.ly/Tb3hU5C

Targets

    • Target

      RFQ 20210520.docx

    • Size

      10KB

    • MD5

      1005c900d1989543f01c87cc34b95986

    • SHA1

      99933ef28b579e9f5db2de17918653c702eab028

    • SHA256

      94db48bcbf4f8f531cb684207c78bd2cfa734317530994d08b9389c64ea5dc40

    • SHA512

      10e8b3a9d518cd689b0f7b65d95c3781301dd22eb6db092d767cbcb678c43bc26b5c006331d2c257e61836d1a992cc8044e222ab0a1003abdf7cb065afbfb4c2

    Score
    7/10

    • Abuses OpenXML format to download file from external location

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks