Overview

overview

10

Static

static

10

20899b27a5...f.docx

windows7-x64

8

20899b27a5...f.docx

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    20899b27a51843830df2084dce88cc97d752a7e2dd1a64ad3238080a145fceaf.zip
  • Size 7KB
  • Sample230308-mgcefafd86
  • SHA256 75abb2c934da164a8f5e7662fddb1ea809355763b23123550761bcef9f4fe285
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
websettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

  • http://WWWEEEEERWEEWWWE0E090W0DDF0F9S0WEWRWQQQ09EW0QQQQQQQQQQQ09W9WEREWRRRRRRRR090R00R2333RERERZZZZ090ZXXX0XXXXXX00XX@392095676/31.31.31.doc

Targets

    • Target
      20899b27a51843830df2084dce88cc97d752a7e2dd1a64ad3238080a145fceaf.doc
    • Size 10KB
    • SHA256 20899b27a51843830df2084dce88cc97d752a7e2dd1a64ad3238080a145fceaf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks