Overview

overview

10

Static

static

8

sample.doc

windows7_x64

10

sample.doc

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20bcf7b597f993862cd19781dbd9306d4eba27ca38749213776a531a5e09528b

  • Size

    98KB

  • Sample

    220520-1y111sedg6

  • MD5

    e1eeb9c8b96fd70259b12211a559602e

  • SHA1

    0c680d7c5f5f1a69c5facdb3c8ff4446573dbb07

  • SHA256

    20bcf7b597f993862cd19781dbd9306d4eba27ca38749213776a531a5e09528b

  • SHA512

    e2e1b611a56901f4668780be0a85e1578390839918b317cc001832c4742dd6cfc4136a075981eb952964946c5d44b9a0c26298fb8e44c6021fedf028660e1a3b

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://manandvanwaterlooville.co.uk/wp-admin/prX892/
exe.dropper

https://uniral.com/captchasignup/4J579681/
exe.dropper

https://scyzm.net/lkx7/lqoH8S/
exe.dropper

https://amagna.nl/DZ9MzAobu3/37Z/
exe.dropper

https://nilinkeji.com/online/90fb31/

Targets

    • Target

      sample

    • Size

      169KB

    • MD5

      09c2396d6f7ff04eb8ea9efe6ac2de76

    • SHA1

      3971cc6bd39ebdbf1ddf2c2e4346722bd330f975

    • SHA256

      1abfc4a49d1fb06ca015eb6a0a2dc71ee2b75a14beddf5c03541d10f752af183

    • SHA512

      e362227e11d93915a5b2395945f380e3f93dc29a7297237e9d2168345280ab3330af530992e68a57c8944c5a52ea3fe7cb1f7a8c7096bbeebc8f4faf6bac9541

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks