Overview

overview

10

Static

static

8

9b808789a8...cf.doc

windows7-x64

10

9b808789a8...cf.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b808789a88144a32f8fd036138403a7235c834f3b3bf5ebbcd22ac4610d32cf.doc

  • Size

    2.8MB

  • Sample

    230326-jykklafh53

  • MD5

    3fd6aaed6aa4fd6fae42ffc02d4fe52a

  • SHA1

    642c92a15fb9b0e9a82d15fdd52c2c92270a4eeb

  • SHA256

    9b808789a88144a32f8fd036138403a7235c834f3b3bf5ebbcd22ac4610d32cf

  • SHA512

    be44cf715020c3f0e0a78dcec45038b4743e3f9e0b48fc4b9c583c06f93d975e0f52a0781c4722194145528f991f338c4056dea8106ea1c45412349b24d790be

  • SSDEEP

    3072:ic8fJkkgynfEv91qh2g4PPHy/q/4mJ9cYNxtE1CeNIyZg1HFZr:iNJkkgo264PPHNjJWSMTGyZaH7r

Score
10/10
evasionmacromacro_on_action

Malware Config

Targets

    • Target

      9b808789a88144a32f8fd036138403a7235c834f3b3bf5ebbcd22ac4610d32cf.doc

    • Size

      2.8MB

    • MD5

      3fd6aaed6aa4fd6fae42ffc02d4fe52a

    • SHA1

      642c92a15fb9b0e9a82d15fdd52c2c92270a4eeb

    • SHA256

      9b808789a88144a32f8fd036138403a7235c834f3b3bf5ebbcd22ac4610d32cf

    • SHA512

      be44cf715020c3f0e0a78dcec45038b4743e3f9e0b48fc4b9c583c06f93d975e0f52a0781c4722194145528f991f338c4056dea8106ea1c45412349b24d790be

    • SSDEEP

      3072:ic8fJkkgynfEv91qh2g4PPHy/q/4mJ9cYNxtE1CeNIyZg1HFZr:iNJkkgo264PPHNjJWSMTGyZaH7r

    Score
    10/10
    evasion

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Hidden Files and Directories

2
T1158

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks