Overview

overview

8

Static

static

Impact of ...an.doc

windows7_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Impact of US and NATO Withdrawal from Afghanistan.doc

  • Size

    125KB

  • Sample

    210712-vrdhabjl9x

  • MD5

    9fae1aa8db790fac114359c34425a727

  • SHA1

    ccc402845b46285d04d1d45db964f3c1a0df51d5

  • SHA256

    e84ebc631097ce15d13619b704d140da2398f7b1502be388f5081ebe66c6aedf

  • SHA512

    6263f15c93131a11b851192dd92c4e179983c0c89f94a60cb194577dffb7590dd465545a292a09ac0d9c291f66492c17473f66eb1609391bdb8487b047ba5b99

Score
8/10
macroxlm

Malware Config

Targets

    • Target

      Impact of US and NATO Withdrawal from Afghanistan.doc

    • Size

      125KB

    • MD5

      9fae1aa8db790fac114359c34425a727

    • SHA1

      ccc402845b46285d04d1d45db964f3c1a0df51d5

    • SHA256

      e84ebc631097ce15d13619b704d140da2398f7b1502be388f5081ebe66c6aedf

    • SHA512

      6263f15c93131a11b851192dd92c4e179983c0c89f94a60cb194577dffb7590dd465545a292a09ac0d9c291f66492c17473f66eb1609391bdb8487b047ba5b99

    Score
    8/10
    macroxlm

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Abuses OpenXML format to download file from external location

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks