Overview

overview

10

Static

static

8

ACHFORMJLI...17.doc

windows7-x64

10

ACHFORMJLI...17.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ACHFORMJLIL09212811597717.doc

  • Size

    232KB

  • Sample

    230630-r9ahrsde73

  • MD5

    01e27446d5dccb690e518dd0d398294f

  • SHA1

    96cc081662e2d8502a56914a754f88a0257c9e00

  • SHA256

    03128d63886828689cca7198e5067843a68493d0c073bfcf22bac23b893afd85

  • SHA512

    97d6e6926604394bd7a8c013bf433b70567e7206af869dc9380ae5320cd567cd41eab87a9ea408fc0fcf1dcd14aa6db93cc8678af4cb2227fae56253f6d501f7

  • SSDEEP

    3072:DlFZ9MOFUca0DNB1Go08MOKXlxwJ1lPwW5RlMXvWoNwKRRWl81X9:RFzFUK6oHMxipwwKR4C3

Score
10/10
macromacro_on_action

Malware Config

Targets

    • Target

      ACHFORMJLIL09212811597717.doc

    • Size

      232KB

    • MD5

      01e27446d5dccb690e518dd0d398294f

    • SHA1

      96cc081662e2d8502a56914a754f88a0257c9e00

    • SHA256

      03128d63886828689cca7198e5067843a68493d0c073bfcf22bac23b893afd85

    • SHA512

      97d6e6926604394bd7a8c013bf433b70567e7206af869dc9380ae5320cd567cd41eab87a9ea408fc0fcf1dcd14aa6db93cc8678af4cb2227fae56253f6d501f7

    • SSDEEP

      3072:DlFZ9MOFUca0DNB1Go08MOKXlxwJ1lPwW5RlMXvWoNwKRRWl81X9:RFzFUK6oHMxipwwKR4C3

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks