Overview

overview

8

Static

static

1

SecuriteIn...69.rtf

windows7-x64

8

SecuriteIn...69.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Exploit.CVE-2017-11882.123.23495.2369.rtf

  • Size

    72KB

  • Sample

    240730-bpj9gazhnm

  • MD5

    625a04a93d1ab1ffac8c456c25d98b93

  • SHA1

    f52a29f1a540c218a8587d4fc81ff209288a7f3c

  • SHA256

    c0587da12abc35d421d5cfb374785b021b0c6c07868d12202ea2074b3cf39def

  • SHA512

    159775ed99ef6eb7ff9edb193208a1831c43074c737d608d78c91bd8bf35d4a801d914b4214958aad38edec943a920389a3e980233b8e9f58c3864986470dec9

  • SSDEEP

    384:l0uKlMPlWYlweoKVLliD/k4gphmStYaFiYXl83D2jIcwMfXEVNkKT:ykXIKVLlOk4gphm4Xl8D2jIcwM/2p

Score
8/10
discoveryexecution

Malware Config

Targets

    • Target

      SecuriteInfo.com.Exploit.CVE-2017-11882.123.23495.2369.rtf

    • Size

      72KB

    • MD5

      625a04a93d1ab1ffac8c456c25d98b93

    • SHA1

      f52a29f1a540c218a8587d4fc81ff209288a7f3c

    • SHA256

      c0587da12abc35d421d5cfb374785b021b0c6c07868d12202ea2074b3cf39def

    • SHA512

      159775ed99ef6eb7ff9edb193208a1831c43074c737d608d78c91bd8bf35d4a801d914b4214958aad38edec943a920389a3e980233b8e9f58c3864986470dec9

    • SSDEEP

      384:l0uKlMPlWYlweoKVLliD/k4gphmStYaFiYXl83D2jIcwMfXEVNkKT:ykXIKVLlOk4gphm4Xl8D2jIcwM/2p

    Score
    8/10
    discoveryexecution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks