Overview

overview

8

Static

static

1

SCB REmitt...ce.rtf

windows7-x64

8

SCB REmitt...ce.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SCB REmittance Advice.doc

  • Size

    138KB

  • Sample

    240523-wwf6lsbe68

  • MD5

    a19ff7526e4447064c95123087783231

  • SHA1

    28cd27bb7050fb4f5534f584b83ca3be90d64ac8

  • SHA256

    bc6fe96306eb0dcd81bbe50db9e9996b01ca39b22efa79fce253d38532353051

  • SHA512

    48fdf3b34fad1e18c44e252caf530ded20a595bf0442ea6d50b90b3d623674a5523cd03fbe37ee9268db3d0b22f2d256aa8f8514894188947174b2d0c3fea9fe

  • SSDEEP

    1536:6wAlRkwAlRkwAlRkwAlRqQD1vzq1VvkwoYOOG:6wAlawAlawAlawAlgQDdyVvzrO3

Score
8/10
execution

Malware Config

Targets

    • Target

      SCB REmittance Advice.doc

    • Size

      138KB

    • MD5

      a19ff7526e4447064c95123087783231

    • SHA1

      28cd27bb7050fb4f5534f584b83ca3be90d64ac8

    • SHA256

      bc6fe96306eb0dcd81bbe50db9e9996b01ca39b22efa79fce253d38532353051

    • SHA512

      48fdf3b34fad1e18c44e252caf530ded20a595bf0442ea6d50b90b3d623674a5523cd03fbe37ee9268db3d0b22f2d256aa8f8514894188947174b2d0c3fea9fe

    • SSDEEP

      1536:6wAlRkwAlRkwAlRkwAlRqQD1vzq1VvkwoYOOG:6wAlawAlawAlawAlgQDdyVvzrO3

    Score
    8/10
    execution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks