Overview

overview

10

Static

static

8

particular...21.doc

windows7_x64

10

particular...21.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    particulars,010.21.doc

  • Size

    34KB

  • Sample

    211021-rqp44sadf9

  • MD5

    69641318c7507bf5547004c1681ae7f2

  • SHA1

    e3f99f178f0021cf8993a06bfb1d6d66b7210773

  • SHA256

    7b45e3906cf74bbecb8bab376e876693f54169208e786ac037fee90f1caa0e97

  • SHA512

    c52935d852cc0ae5553e44c8cf5de839ced1b4656e6757d7ef03cd5c39170a027f3d88f3da3dcca7013088f091b63d876126767af9d24cec47068eaa64984c22

Score
10/10
macro

Malware Config

Targets

    • Target

      particulars,010.21.doc

    • Size

      34KB

    • MD5

      69641318c7507bf5547004c1681ae7f2

    • SHA1

      e3f99f178f0021cf8993a06bfb1d6d66b7210773

    • SHA256

      7b45e3906cf74bbecb8bab376e876693f54169208e786ac037fee90f1caa0e97

    • SHA512

      c52935d852cc0ae5553e44c8cf5de839ced1b4656e6757d7ef03cd5c39170a027f3d88f3da3dcca7013088f091b63d876126767af9d24cec47068eaa64984c22

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks