Overview

overview

10

Static

static

8

challenge-...st.hta

windows10-2004-x64

7

challenge-...1.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    challenge-files.zip

  • Size

    4.8MB

  • Sample

    220901-nqbd6sdafr

  • MD5

    4edf33b3a4dd1c1c005aefeaa29c7f1d

  • SHA1

    e4d4bb8c8dcf357b068019660fdc72e65f577857

  • SHA256

    d312c079c51f2bf011902df86e1ca4cac84eb7c74ff104fa48a505caa88ef2fe

  • SHA512

    b647d071e71ece4a4d5d4601f28cbcab9f12a85014f1d06cc80ed65f35c7d3f81fc0b27cfd0855b456194f50e7f5dd2ce9588077735c2ec7f43f4a1e38ee2803

  • SSDEEP

    98304:DfFixex8es3YZIbSNMDHMDhODrxaQe8vNzLB/RensEGdCW/1BTK4EBzaQyLzZ:sAx8eOHawsDhk0QlvNLB/0nsEGdCWNIu

Score
10/10
macro

Malware Config

Targets

    • Target

      challenge-files/challenge-files/collectionBoxConst.hta

    • Size

      3KB

    • MD5

      99a1a4391c6be3ac5f137c0a092d8edd

    • SHA1

      34afc663a569d0ba183c73ab40ae8d682273d193

    • SHA256

      b25865183c5cd2c5e550aca8476e592b62ed3e37e6b628f955bbed454fdbb100

    • SHA512

      45e5b38d72add4d28234b539071a3cb4059c9c104b5389a43190fd3197843e103fdaf7552c1edcb9bbbabe15b122a8bef0389ce39d6130b438a835c4c2d4f345

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

    • Target

      challenge-files/challenge-files/docs 06.02.2021.doc

    • Size

      43KB

    • MD5

      f08771b9fdfe82caaa089641e2348c8e

    • SHA1

      b02c121597c9d56d7fab76b54834d5f3bd961e8c

    • SHA256

      cc721111b5924cfeb91440ecaccc60ecc30d10fffbdab262f7c0a17027f527d1

    • SHA512

      3bb2b582e7119c346473f78056f95e0890a3e74976de733739af9aaef810c4e62b35d7f81ec52acfbf675d3d501a048a36fa323ef76ee8843502424211b46ebd

    • SSDEEP

      768:u5WkgUEeFPIlj5oQ0fUDjxXSwU/+BtgKpyAAlQg6DPLFXS:plekVoQTCFmgKpslepC

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

6
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks