Overview

overview

8

Static

static

RFQ - 4 SC...EE.doc

windows7_x64

8

RFQ - 4 SC...EE.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ - 4 SCH 160 EQUAL TEE.doc

  • Size

    3KB

  • Sample

    210722-jr8x56vxds

  • MD5

    79f6a7543d65577041b6e60db871487e

  • SHA1

    79f9bfc7211f680bb2b1390e72f2700904c9c37f

  • SHA256

    f044c02fa90549daa3544371c7e003b424db14944c4ca34d9f78170755a69809

  • SHA512

    09dc37b4a178d1f740ad546b8e9e45cd0f39b7770189c031d3f943eb5a8337fb7e4c1d81f2c11dd8a4fea70de9ce0c335294bf4138b6e2b15a81a1e9c394ade5

Score
8/10

Malware Config

Targets

    • Target

      RFQ - 4 SCH 160 EQUAL TEE.doc

    • Size

      3KB

    • MD5

      79f6a7543d65577041b6e60db871487e

    • SHA1

      79f9bfc7211f680bb2b1390e72f2700904c9c37f

    • SHA256

      f044c02fa90549daa3544371c7e003b424db14944c4ca34d9f78170755a69809

    • SHA512

      09dc37b4a178d1f740ad546b8e9e45cd0f39b7770189c031d3f943eb5a8337fb7e4c1d81f2c11dd8a4fea70de9ce0c335294bf4138b6e2b15a81a1e9c394ade5

    Score
    8/10

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks