Resubmissions

08/08/2023, 14:40

230808-r19aqsef4z 8

08/08/2023, 14:27

230808-rsfcpada69 8

08/08/2023, 14:23

230808-rqmnzsda63 1

08/08/2023, 14:17

230808-rl7tcsee8x 8

General

  • Target

    Fortune 1000 Event Invitation (1).pdf

  • Size

    204KB

  • Sample

    230808-rsfcpada69

  • MD5

    0e69f04338e206ce0d45c2cd99c1c789

  • SHA1

    0c59747fa002f282863a1b1c248e2d55704e127d

  • SHA256

    c3fffb3fc30cad31e127d712be0bc37cb1cff1f151f18865ad3d8d3dc422a3aa

  • SHA512

    df0923d71d5bac3697b98cf2e0d688e07b3f0a845af7205299c573c8db86ce0f1bd5149a33790bb0cc435a45b11553f5c15e239cc0b2bfdabc8885d2e2db1411

  • SSDEEP

    3072:avQUES0aGvBYk54rSP8SEnjRNUsMAPOilji9BzYs4NCjnrnqYBiOuCsoFM+:QEIG5Ykq0EjRNUstWVzYs0NYBi9oFt

Malware Config

Targets

    • Target

      Fortune 1000 Event Invitation (1).pdf

    • Size

      204KB

    • MD5

      0e69f04338e206ce0d45c2cd99c1c789

    • SHA1

      0c59747fa002f282863a1b1c248e2d55704e127d

    • SHA256

      c3fffb3fc30cad31e127d712be0bc37cb1cff1f151f18865ad3d8d3dc422a3aa

    • SHA512

      df0923d71d5bac3697b98cf2e0d688e07b3f0a845af7205299c573c8db86ce0f1bd5149a33790bb0cc435a45b11553f5c15e239cc0b2bfdabc8885d2e2db1411

    • SSDEEP

      3072:avQUES0aGvBYk54rSP8SEnjRNUsMAPOilji9BzYs4NCjnrnqYBiOuCsoFM+:QEIG5Ykq0EjRNUstWVzYs0NYBi9oFt

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

    • Sets file execution options in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

MITRE ATT&CK Enterprise v15

Tasks