Overview

overview

7

Static

static

1

WordMat130.exe

windows10-1703-x64

WordMat130.exe

windows10-2004-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WordMat130.exe

  • Size

    179.8MB

  • Sample

    240819-hb9ersygqa

  • MD5

    50862563aa624426b06689a483519a7c

  • SHA1

    bb4a2003ed06bb6c97854fdfe5f306fa12e974cb

  • SHA256

    20fe6a586148109a4e9ebdedcb688a06d30fa8cf63380cce84584acc4865c986

  • SHA512

    540a3b0086f4f70dc6900266f8408551e02ce0443cdb131f89d1f3cea9fba6614b39eddf348e485501c7757d57696dec383a41a41a90c47b9c46d3d1e3498858

  • SSDEEP

    3145728:6iGM5vKvhGo8aDbXRvxbbmSFNYgfXQwSrcW0y1ojlT5AiBMYqxZtzo:NGYviHpvJaScICrqyy8iBMlt8

Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      WordMat130.exe

    • Size

      179.8MB

    • MD5

      50862563aa624426b06689a483519a7c

    • SHA1

      bb4a2003ed06bb6c97854fdfe5f306fa12e974cb

    • SHA256

      20fe6a586148109a4e9ebdedcb688a06d30fa8cf63380cce84584acc4865c986

    • SHA512

      540a3b0086f4f70dc6900266f8408551e02ce0443cdb131f89d1f3cea9fba6614b39eddf348e485501c7757d57696dec383a41a41a90c47b9c46d3d1e3498858

    • SSDEEP

      3145728:6iGM5vKvhGo8aDbXRvxbbmSFNYgfXQwSrcW0y1ojlT5AiBMYqxZtzo:NGYviHpvJaScICrqyy8iBMlt8

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks