Overview

overview

10

Static

static

8

challenge-...1.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    challenge-files.zip

  • Size

    4.8MB

  • Sample

    220810-n278aabgb6

  • MD5

    4edf33b3a4dd1c1c005aefeaa29c7f1d

  • SHA1

    e4d4bb8c8dcf357b068019660fdc72e65f577857

  • SHA256

    d312c079c51f2bf011902df86e1ca4cac84eb7c74ff104fa48a505caa88ef2fe

  • SHA512

    b647d071e71ece4a4d5d4601f28cbcab9f12a85014f1d06cc80ed65f35c7d3f81fc0b27cfd0855b456194f50e7f5dd2ce9588077735c2ec7f43f4a1e38ee2803

Score
10/10
macropersistence

Malware Config

Targets

    • Target

      challenge-files/challenge-files/docs 06.02.2021.doc

    • Size

      43KB

    • MD5

      f08771b9fdfe82caaa089641e2348c8e

    • SHA1

      b02c121597c9d56d7fab76b54834d5f3bd961e8c

    • SHA256

      cc721111b5924cfeb91440ecaccc60ecc30d10fffbdab262f7c0a17027f527d1

    • SHA512

      3bb2b582e7119c346473f78056f95e0890a3e74976de733739af9aaef810c4e62b35d7f81ec52acfbf675d3d501a048a36fa323ef76ee8843502424211b46ebd

    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks