Overview

overview

10

Static

static

8

a515d869a7...ac.doc

windows7-x64

10

a515d869a7...ac.doc

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a515d869a75da322c87985158750d4e12f5556b0785379d558d778e3ef481eac

  • Size

    36KB

  • Sample

    240719-1h36fa1dnl

  • MD5

    e01f640fbceaf6a2584e49d047d89176

  • SHA1

    75e0ecbfd3029a11dccecb682fffc45dbb60f2bd

  • SHA256

    a515d869a75da322c87985158750d4e12f5556b0785379d558d778e3ef481eac

  • SHA512

    11e5c2fd6b6068fbb8116684d904691d75ce7211d6c315c2e138baa8afc859c469b56c27a3e7ea151bef7fca9012d4e6f1b7dc23cd0634f2b35d12dd1a042d62

  • SSDEEP

    384:wAMiS8px8SMDIdyK118MD32suJcXNBB3Su0jijm:d3y2yK3zD32JJcXLEud

Score
10/10
macromacro_on_action

Malware Config

Targets

    • Target

      a515d869a75da322c87985158750d4e12f5556b0785379d558d778e3ef481eac

    • Size

      36KB

    • MD5

      e01f640fbceaf6a2584e49d047d89176

    • SHA1

      75e0ecbfd3029a11dccecb682fffc45dbb60f2bd

    • SHA256

      a515d869a75da322c87985158750d4e12f5556b0785379d558d778e3ef481eac

    • SHA512

      11e5c2fd6b6068fbb8116684d904691d75ce7211d6c315c2e138baa8afc859c469b56c27a3e7ea151bef7fca9012d4e6f1b7dc23cd0634f2b35d12dd1a042d62

    • SSDEEP

      384:wAMiS8px8SMDIdyK118MD32suJcXNBB3Su0jijm:d3y2yK3zD32JJcXLEud

    Score
    10/10
    macromacro_on_action

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Office macro that triggers on suspicious action

      Office document macro which triggers in special circumstances - often malicious.

      macromacro_on_action

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks