Overview

overview

10

Static

static

10

Challenge_...m.docx

windows7_x64

4

Challenge_...m.docx

windows10-2004_x64

1

Challenge_...1.docx

windows7_x64

4

Challenge_...1.docx

windows10-2004_x64

1

Challenge_...y.docx

windows7_x64

4

Challenge_...y.docx

windows10-2004_x64

1

Challenge_...1.docx

windows7_x64

4

Challenge_...1.docx

windows10-2004_x64

1

tools/numb...ing.py

linux_amd64

tools/numb...ing.py

linux_armhf

tools/numb...ing.py

linux_mips

tools/numb...ing.py

linux_mipsel

decoder_add1.py

linux_amd64

decoder_add1.py

linux_armhf

decoder_add1.py

linux_mips

decoder_add1.py

linux_mipsel

decoder_ah.py

linux_amd64

decoder_ah.py

linux_armhf

decoder_ah.py

linux_mips

decoder_ah.py

linux_mipsel

decoder_chr.py

linux_amd64

decoder_chr.py

linux_armhf

decoder_chr.py

linux_mips

decoder_chr.py

linux_mipsel

decoder_rol1.py

linux_amd64

decoder_rol1.py

linux_armhf

decoder_rol1.py

linux_mips

decoder_rol1.py

linux_mipsel

decoder_xor1.py

linux_amd64

decoder_xor1.py

linux_armhf

decoder_xor1.py

linux_mips

decoder_xor1.py

linux_mipsel

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mshtml.zip

  • Size

    262KB

  • Sample

    220505-s2h1lsbadl

  • MD5

    75a28db68a020da28cf223010f7c9f9c

  • SHA1

    361aa10961eed91b277ffea70641ed6435550d7d

  • SHA256

    31475717735f9aee20def2a4044b42a52cb92e8cf885b92a042099a273688135

  • SHA512

    6fbe84b932773d0e0f7b12ddcbb4d2b6f802036f71f42f95b65bed7d3a262db3609bbbc4ee8c54a5ee86c5e952da059bba1fd99ac532c07401a3bf98068f3964

Score
10/10
linux

Malware Config

Extracted

Rule
Microsoft Office MHTML OLEObject
C2

arsenal.30cm.tw:1212/word.html

http://175.24.190.249/note.html

http://trendparlye.com/wiki0509.html

http://hidusi.com/e8c76295a5f9acb7/side.html

Targets

    • Target

      Challenge_FIles/Employee_W2_Form.docx

    • Size

      12KB

    • MD5

      45e7d6562bfddb816d45649dd667abde

    • SHA1

      00087e46ec0ef6225de59868fd016bd9dd77fa3c

    • SHA256

      679bbe0c50754853978a3a583505ebb99bce720cf26a6aaf8be06cd879701ff1

    • SHA512

      0567873b42eece93787da4f4c3b72ecb0d952450d8eb59b354a5f91ed95395a2662171e05cdcf4a829fdbd0b5cbcca97701fef9b96b1ad0d8728922bbd0288fa

    Score
    4/10
    behavioral1behavioral2

    • Target

      Challenge_FIles/Employees_Contact_Audit_Oct_2021.docx

    • Size

      12KB

    • MD5

      d5742309ba8146be9eab4396fde77e4e

    • SHA1

      8aaa79ee4a81d02e1023a03aee62a47162a9ff04

    • SHA256

      ed2b9e22aef3e545814519151528b2d11a5e73d1b2119c067e672b653ab6855a

    • SHA512

      37367ea06191c8a949f6c092bc4137736b344cc9892bf8a19e149557919d9276fb1301009a700cede0f2ca05d6827c827992817aee7b8968a5429e433fe0c8ba

    Score
    4/10
    behavioral3behavioral4

    • Target

      Challenge_FIles/Work_From_Home_Survey.doc

    • Size

      26KB

    • MD5

      41dacae2a33ee717abcc8011b705f2cb

    • SHA1

      4b35d14a2eab2b3a7e0b40b71955cdd36e06b4b9

    • SHA256

      84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69

    • SHA512

      11f7177dc3c8a804ff6450477e15aadd20fddac98205008db25a4f6ef69a54b7cb7c9dd0d7bdf1b1d317f306482d86ad5ef150530194de7d8dbe344203962648

    Score
    4/10
    behavioral5behavioral6

    • Target

      Challenge_FIles/income_tax_and_benefit_return_2021.docx

    • Size

      23KB

    • MD5

      55998cb43459159a5ed4511f00ff3fc8

    • SHA1

      9bec2182cc5b41fe8783bb7ab6e577bac5c19f04

    • SHA256

      d0e1f97dbe2d0af9342e64d460527b088d85f96d38b1d1d4aa610c0987dca745

    • SHA512

      8f04951f9efb5acdad0a625d9f63154089d552fe4281ca53a759cc0a0468b8d9c76af863e34ed6e00802225a4408bcda1110a6efce30357e6173973ea5bf7838

    Score
    4/10
    behavioral7behavioral8

    • Target

      tools/numbers-to-string.py

    • Size

      17KB

    • MD5

      d139e5574623629a158c7cbd0c47b6a6

    • SHA1

      5f6a403b2c0341d917a8e9c9ab84dc76fc9199b2

    • SHA256

      332822ca13b283da92f399ac407ab0a99ab18df32e5996cee9386be54ba8a225

    • SHA512

      1d4dfee764c3fc0b1d9041599654b6e6dc55df40ab96b0517654abc5bb74f6b707fac964946412ea03892a5d573e61435d958315528a7c0490adbf07ac78bf26

    Score
    1/10
    behavioral9behavioral10behavioral11behavioral12

    • Target

      decoder_add1.py

    • Size

      1KB

    • MD5

      16134bb702ffb7e747be59fb18875f21

    • SHA1

      c070016a18ee1775ade0abf3a599cdc05bf6f67b

    • SHA256

      3ae45cdaf1550a9240d3c96e5c723729ba1aae2d84f0562ba0505662d8506edb

    • SHA512

      d770e77a7f17b3e4f3f17302513b33333b920477034f4f43c81a9049347995b0ae1f2abf6295a3e94b738db56e5da14340f8223be79cbbb25372a20fc4bf72eb

    Score
    1/10
    behavioral13behavioral14behavioral15behavioral16

    • Target

      decoder_ah.py

    • Size

      1KB

    • MD5

      e99956971f7cfd746e8f04818b93db46

    • SHA1

      f457eab1ca20f71eb136db827a71e467d95c1664

    • SHA256

      8941b1e1baf50cf2064cc8387631887568075433fb6feb05f06b25fe433bab3e

    • SHA512

      20dd1c3adf7ed254101d14729a706e06df9189715b08bb1d1cf7688006072495db7f5c9e6e8c6620b4796ccdcf0ca5996f5ff4f9cc76f29e4cb2b92404678a9d

    Score
    1/10
    behavioral17behavioral18behavioral19behavioral20

    • Target

      decoder_chr.py

    • Size

      1KB

    • MD5

      7b00691dd2e22b681255da495c3599b6

    • SHA1

      c29c91b7bd585a3134bf41b3b544f8a67040ed2f

    • SHA256

      4c7885a4a36271b1822b852b85f519323b49b3d69d4c4921988de19dd07b4986

    • SHA512

      d70155c20e2402f46b08b262f180c5f77c64b893f93d5584d37f4ac3ead5222c41aaed74e6151ee41c932c9f9968de538ba2a0e6202c6b342bac5a46e72a7881

    Score
    1/10
    behavioral21behavioral22behavioral23behavioral24

    • Target

      decoder_rol1.py

    • Size

      1KB

    • MD5

      dbc7c606edba8c865a29534a03cddada

    • SHA1

      ae27f0aef5cca833c9d8a5940ca3f22a5c8579bd

    • SHA256

      72b3d0d684f32b85f9add43619cf354efe983e4724301c4d2cae014b9c033f2e

    • SHA512

      211b47516d3a3695e4dd302fd3663ca40db590fea1940195b89a5a2f93b6fb2df97a8fb97a36340e33360d60c3ec11e35be87812bc74d1c88c03fb50335bb2de

    Score
    1/10
    behavioral25behavioral26behavioral27behavioral28

    • Target

      decoder_xor1.py

    • Size

      1KB

    • MD5

      5cd782490b1bebf29544c1d92e77a930

    • SHA1

      881ba2f99f4a9cdc2ebc1545aa298984e0b1f372

    • SHA256

      1d2cd9dc1a82343f2373d5c6f30314d0749c6cc2c1fd8469008cc196242ae386

    • SHA512

      64612d38b17649a69bf5ea42ee690d985601bbe64f22c27521e4568118398e7774edec52cfc457cb048393ff000206952d6ef9dc643bc7b5f0b8f223dced1029

    Score
    1/10
    behavioral29behavioral30behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

8
T1012

System Information Discovery

8
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks