Overview

overview

10

Static

static

8

QPL_0600_3...25.doc

windows7_x64

10

QPL_0600_3...25.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QPL_0600_310107725.doc

  • Size

    28KB

  • Sample

    211014-mcjb7aghd7

  • MD5

    38aa23ee6f3164562c75b9584ddd8bf7

  • SHA1

    75982c488ae86664e2b3420fbfec12bd22e75b81

  • SHA256

    ce0784a0d4e7afe62964a890c549c42743fa1cc5d9bf78204a225c9bd2e3b2c6

  • SHA512

    f3283f73453c014e7d45aa2e96db6f2e6241c498683d146ca41cf323e9a3a7d616dcefba78778bdb13e3d26dd9e12d3feb22841e0779a6322d1af05a76f58623

Score
10/10
macromacro_on_actionxlm

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://18.195.143.183/6/7/QPL_0600_310107725.exe

Targets

    • Target

      QPL_0600_310107725.doc

    • Size

      28KB

    • MD5

      38aa23ee6f3164562c75b9584ddd8bf7

    • SHA1

      75982c488ae86664e2b3420fbfec12bd22e75b81

    • SHA256

      ce0784a0d4e7afe62964a890c549c42743fa1cc5d9bf78204a225c9bd2e3b2c6

    • SHA512

      f3283f73453c014e7d45aa2e96db6f2e6241c498683d146ca41cf323e9a3a7d616dcefba78778bdb13e3d26dd9e12d3feb22841e0779a6322d1af05a76f58623

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks