Overview

overview

10

Static

static

8

Resume v0.1.doc

windows7-x64

10

Resume v0.1.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Resume v0.1.doc

  • Size

    39KB

  • Sample

    240424-bh72ysdd8z

  • MD5

    ca5c5a30307f853d9ddd57bf60ebd2ed

  • SHA1

    5bb802f8d140818066b78bec2b102dea398dbc16

  • SHA256

    4b5f8c83f63c4268e5006c8f7c98fea1196d8a20b195788c65aafe4c399a5eac

  • SHA512

    761af1c18986f7ed22ca5f224bf5f954861dffbbfb3626849ab79f2101a2ae46387b94f824c9090073578041f205081e4434ec0764ff71c3e9c751fa972e1e4e

  • SSDEEP

    384:+LIieom6t2pwGiSJPw+QD1fT36iDNvxz99E50j7S/t:AIieom6t2M+k77Dxxz99Q

Score
10/10
macromacro_on_action

Malware Config

Targets

    • Target

      Resume v0.1.doc

    • Size

      39KB

    • MD5

      ca5c5a30307f853d9ddd57bf60ebd2ed

    • SHA1

      5bb802f8d140818066b78bec2b102dea398dbc16

    • SHA256

      4b5f8c83f63c4268e5006c8f7c98fea1196d8a20b195788c65aafe4c399a5eac

    • SHA512

      761af1c18986f7ed22ca5f224bf5f954861dffbbfb3626849ab79f2101a2ae46387b94f824c9090073578041f205081e4434ec0764ff71c3e9c751fa972e1e4e

    • SSDEEP

      384:+LIieom6t2pwGiSJPw+QD1fT36iDNvxz99E50j7S/t:AIieom6t2M+k77Dxxz99Q

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks