Overview

overview

10

Static

static

8

certificat...21.doc

windows7_x64

10

certificat...21.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Info.zip

  • Size

    42KB

  • Sample

    211021-zees1aaga4

  • MD5

    69fca9509a5acadbbf5ff410c8f5a8dd

  • SHA1

    a3dc342370fde6a7bda7a15ca3694c25499b8feb

  • SHA256

    66f8131b30c926ba68558b4976f46447ea24116c55249e7bcac6dd23a6cb3224

  • SHA512

    00bb5b2609e60b95b7ff9702c5d9ff97367613a0b9368874177a128159e373eca1d7fd37409e270d9a6866ef78f8b248abf4182a3af6bd8f9ca280b0bd208e51

Score
10/10
macro

Malware Config

Targets

    • Target

      certificate.010.21.doc

    • Size

      34KB

    • MD5

      f58cbc77264954ce63205bdbaee93f25

    • SHA1

      3b61d17939067fa6086c09260edd5951cc797e81

    • SHA256

      2588782842cfb9bfe76b4516ad66aee020b5f5d90f74a91106840c4491c78cf8

    • SHA512

      9e2a98e3418715b37ba02953c75828b85b818a9c140de97f4cc7164ae3a4f00a8537342d38c09051d94dfad0a60b8d7dd3d069a897100d4f1781c8fe012425a4

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks