Overview

overview

10

Static

static

10

f130a88035...b5.doc

windows7_x64

7

f130a88035...b5.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f130a880350c53f3f002f53cc0c056ee489fd924593b8813fff4dd96013b7eb5

  • Size

    10KB

  • Sample

    210616-4xfb4185dn

  • MD5

    25ee37354c2bf9c5f8ca70c672e32922

  • SHA1

    e292cb1967bbed0100f8a1fc61053c63800a7fc2

  • SHA256

    f130a880350c53f3f002f53cc0c056ee489fd924593b8813fff4dd96013b7eb5

  • SHA512

    c2c35890ce4adc813681055947bbf81468b5f1dd72726247053a64aebc0a4fe9b63da2cf4c95f2e33c35bc73d7e9be016b3cd6e61941a425a19d839042656044

Score
10/10
websettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

https://dummy_username@itsssl.com/HmRD0

Targets

    • Target

      f130a880350c53f3f002f53cc0c056ee489fd924593b8813fff4dd96013b7eb5

    • Size

      10KB

    • MD5

      25ee37354c2bf9c5f8ca70c672e32922

    • SHA1

      e292cb1967bbed0100f8a1fc61053c63800a7fc2

    • SHA256

      f130a880350c53f3f002f53cc0c056ee489fd924593b8813fff4dd96013b7eb5

    • SHA512

      c2c35890ce4adc813681055947bbf81468b5f1dd72726247053a64aebc0a4fe9b63da2cf4c95f2e33c35bc73d7e9be016b3cd6e61941a425a19d839042656044

    Score
    7/10

    • Abuses OpenXML format to download file from external location

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks