Overview

overview

10

Static

static

document.07.21.doc

windows7_x64

10

document.07.21.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document.07.21.doc

  • Size

    69KB

  • Sample

    210722-2rrzjqcmma

  • MD5

    8198d8aad8008d4b95402f749845b7a1

  • SHA1

    894b40166b312ba747bd379194e00fbea438168c

  • SHA256

    540f3827790f6809cec591526813a664fa4e428e49271211667940a808e70614

  • SHA512

    0563fa6d5382c917a2bd2e054b25dc3f555866296ab2eeffacfafcff1e93fa6d05af0cba1004759b3a6f469232433647fda8b6e5e11f57131ce8fb1f2cfb048d

Score
10/10

Malware Config

Targets

    • Target

      document.07.21.doc

    • Size

      69KB

    • MD5

      8198d8aad8008d4b95402f749845b7a1

    • SHA1

      894b40166b312ba747bd379194e00fbea438168c

    • SHA256

      540f3827790f6809cec591526813a664fa4e428e49271211667940a808e70614

    • SHA512

      0563fa6d5382c917a2bd2e054b25dc3f555866296ab2eeffacfafcff1e93fa6d05af0cba1004759b3a6f469232433647fda8b6e5e11f57131ce8fb1f2cfb048d

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks