Overview

overview

10

Static

static

10

Upgrade Form.docx

windows7_x64

7

Upgrade Form.docx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Upgrade Form.docx

  • Size

    10KB

  • Sample

    211014-hq9zvagch4

  • MD5

    c4d5af4d02cc293efe985d7e87453b60

  • SHA1

    3476965d34e1033ccff9d3a92e9e4914e0376db1

  • SHA256

    1aa681f9c334b5edc51faddf67a4069d65f9b12951415a0dbf3707146aaf8189

  • SHA512

    eb80f27f7ed94aa59ac292c2cae0a698b2409eb937c2c3ecf9c1ec40f1fcbd476a38807d2795ac0c831bdf71c7ac52d4c726257d24a00592daa5bdb3f495609c

Score
10/10
websettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

https://goo-gl.ru.com/sVz

Targets

    • Target

      Upgrade Form.docx

    • Size

      10KB

    • MD5

      c4d5af4d02cc293efe985d7e87453b60

    • SHA1

      3476965d34e1033ccff9d3a92e9e4914e0376db1

    • SHA256

      1aa681f9c334b5edc51faddf67a4069d65f9b12951415a0dbf3707146aaf8189

    • SHA512

      eb80f27f7ed94aa59ac292c2cae0a698b2409eb937c2c3ecf9c1ec40f1fcbd476a38807d2795ac0c831bdf71c7ac52d4c726257d24a00592daa5bdb3f495609c

    Score
    7/10

    • Abuses OpenXML format to download file from external location

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks