Overview

overview

10

Static

static

10

0cabd94f0a...d.docx

windows7-x64

8

0cabd94f0a...d.docx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73eb1fe347f4570fa1fbcbd6b5130f54.bin

  • Size

    7KB

  • Sample

    230222-btsfmshc88

  • MD5

    9d0b64f16fa3e3ed4ca20277cb1afa7b

  • SHA1

    39f749d58a9a8d60a27472c820dedabbd2984f2c

  • SHA256

    923b75bbec5c14b3fcbe8f29f2711fa6a32b7e3fa3407c12428ea1fe22393787

  • SHA512

    319402e1408950a902cf0f6cd8184aa0aada3e31cc69832c9bc5e124c08d5527fbebb443c5da214162bb9faba9273d56ec94982fb01755e51c4ff8203d024dd4

  • SSDEEP

    192:TFU2lqnR1pA7d/aIKN3B+fPnXamLbfbDB6f/uWia8sHmgP:GZnRgfKN3B+fPXTLbfbDspxHP

Score
10/10
websettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

http://WEEEERRRRRRRRRRRPPPOOOOSSSSSSSOOOOOPPWEEEEEEEOOOOOOOCCVVVVVVVVOVVVVVVVVVVVVVVVVOOOOOO@1755848856/O__O.DOC

Targets

    • Target

      0cabd94f0a906814f15908d2349fddb421d3e15d4879f8cd993c7c518d954ddd.doc

    • Size

      10KB

    • MD5

      73eb1fe347f4570fa1fbcbd6b5130f54

    • SHA1

      dc5df0f94c44ad73c16df705f042a88c21f641cc

    • SHA256

      0cabd94f0a906814f15908d2349fddb421d3e15d4879f8cd993c7c518d954ddd

    • SHA512

      2cf93df5e0cf20037629f5ff99f0969031ac09aa12f1e3e2361f9b2b7852023228fea71684d137e721856bc844aebe210370c2bcc8b801452820fdb3f405a175

    • SSDEEP

      192:ScIMmtP0xfUW70vG/b3kgOi4OLO7qus+1pReDnc37FSR:SPX+si10ni4OnyeDnMJ2

    Score
    8/10

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks