Overview

overview

10

Static

static

8

2d3e0abe96...f7.doc

windows7-x64

10

2d3e0abe96...f7.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7

  • Size

    139KB

  • Sample

    221125-k2c6csaf2s

  • MD5

    1e48ce79696508bbdfab22a36543dc08

  • SHA1

    bc5b0b693fb92ddde3f718dab64efacf0a95ac60

  • SHA256

    2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7

  • SHA512

    67ed8265be1015e01d57b41e41208518c3ac081bcc791b7010c00cb2423ec166a8a9a35d7b4501a81eeb8b81f66fb20bc7b5bfa8bc3ab2fa8fcd140ab64e8571

  • SSDEEP

    1536:DLh81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadnf+aSzdgY7JM8E2LxUkB:58GhDS0o9zTGOZD6EbzCd+JM8X1B

Score
10/10
macro

Malware Config

Targets

    • Target

      2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7

    • Size

      139KB

    • MD5

      1e48ce79696508bbdfab22a36543dc08

    • SHA1

      bc5b0b693fb92ddde3f718dab64efacf0a95ac60

    • SHA256

      2d3e0abe9642057ed898507a4fe9f0f665fe3ca1655b5e818bd5fbdd87b313f7

    • SHA512

      67ed8265be1015e01d57b41e41208518c3ac081bcc791b7010c00cb2423ec166a8a9a35d7b4501a81eeb8b81f66fb20bc7b5bfa8bc3ab2fa8fcd140ab64e8571

    • SSDEEP

      1536:DLh81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadnf+aSzdgY7JM8E2LxUkB:58GhDS0o9zTGOZD6EbzCd+JM8X1B

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks