Overview

overview

10

Static

static

8

material,010.21.doc

windows7_x64

10

material,010.21.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    material,010.21.doc

  • Size

    34KB

  • Sample

    211021-s4c75sbdbm

  • MD5

    dc73aee9c97fb76e959bb258ded63cac

  • SHA1

    701f8a6067cee2dbde89f7a2445d862f5a272234

  • SHA256

    26ff73d61dd6b810ed9e69aa74426b3934e3d575ac5a7c5b15eb889b8b927add

  • SHA512

    86456549ef6ec06554ffcbc0696cf2d5448f03387a6408cb88f07c66e0986eb6e925ae65b1695c1fa48a1e4448eaff78e8b9d6216b97073666ff1e3db2355451

Score
10/10
macro

Malware Config

Targets

    • Target

      material,010.21.doc

    • Size

      34KB

    • MD5

      dc73aee9c97fb76e959bb258ded63cac

    • SHA1

      701f8a6067cee2dbde89f7a2445d862f5a272234

    • SHA256

      26ff73d61dd6b810ed9e69aa74426b3934e3d575ac5a7c5b15eb889b8b927add

    • SHA512

      86456549ef6ec06554ffcbc0696cf2d5448f03387a6408cb88f07c66e0986eb6e925ae65b1695c1fa48a1e4448eaff78e8b9d6216b97073666ff1e3db2355451

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks