Overview

overview

10

Static

static

8

Resign let...e.dotm

windows7-x64

10

Resign let...e.dotm

windows10-2004-x64

10

Resubmissions

05/03/2024, 09:13

240305-k69ecsbc7v 10

05/03/2024, 09:10

240305-k5j33scb43 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Resign letter template.dotm

  • Size

    25KB

  • Sample

    240305-k69ecsbc7v

  • MD5

    5c653056d0cf27e16c81dd28480ee5fc

  • SHA1

    dba99563d1baccb14235602e74806d89824df168

  • SHA256

    bfbaed7765743e3eb2642352de5a09be244fa74685f23394eaa0a04a64b3d638

  • SHA512

    7860065f647e6cff5df6bdc93e776ecc519ccea2b53057276b69eb2b5344f858ca692289cdb67094af1449a461f0545285cf727460dce4713cffb714fac3d310

  • SSDEEP

    384:8tgsD/qrzHHfhNZq1ANLSutF1EPKR2pwtgjAptXZnr4tHaJHOVpRt05Y:OhDqvf3RSMFmKR2pwtgcp9YRqY

Score
10/10
macro

Malware Config

Targets

    • Target

      Resign letter template.dotm

    • Size

      25KB

    • MD5

      5c653056d0cf27e16c81dd28480ee5fc

    • SHA1

      dba99563d1baccb14235602e74806d89824df168

    • SHA256

      bfbaed7765743e3eb2642352de5a09be244fa74685f23394eaa0a04a64b3d638

    • SHA512

      7860065f647e6cff5df6bdc93e776ecc519ccea2b53057276b69eb2b5344f858ca692289cdb67094af1449a461f0545285cf727460dce4713cffb714fac3d310

    • SSDEEP

      384:8tgsD/qrzHHfhNZq1ANLSutF1EPKR2pwtgjAptXZnr4tHaJHOVpRt05Y:OhDqvf3RSMFmKR2pwtgcp9YRqY

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks