Overview

overview

10

Static

static

8

confirmation.doc

windows7_x64

10

confirmation.doc

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e42f70cff686d207749d89fc79cc118fdab84bbe647d392c37277b5a97ae8c0d

  • Size

    9KB

  • Sample

    220521-nsk2dshbfm

  • MD5

    e9b8af0da65bdebd6495d90d6f5ea9bf

  • SHA1

    c33c57f6a985b826ef70714d8f56a1e3f31c7a2a

  • SHA256

    e42f70cff686d207749d89fc79cc118fdab84bbe647d392c37277b5a97ae8c0d

  • SHA512

    fdfa8cdd86cae4623926e0c6d6aba364a88b8ba604961c850e91162671da308b2808fd1940d9dec8807ed02d029f97a1d63c7672780103faffafb61610dd1e1b

Score
10/10
macro

Malware Config

Targets

    • Target

      confirmation.doc

    • Size

      32KB

    • MD5

      7c777caa699a828658624818271dbb8b

    • SHA1

      75a2a8e73566c5ae7b61597faa62348341296c2e

    • SHA256

      3142977bcfdcb210911cafe45c3bfe32085ba994cdc0eaa216beef13e8c2a43e

    • SHA512

      a12455fb64936782db231524e484de6d6d18d7737581e3a1393f3b5cbed2be33631c6b1fb317044c6ea5a6be163e34b9b3f1a5cc9ec3488344b3e420fa0ea4cb

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks