Overview

overview

10

Static

static

1

SMTP-FGMet...78.xls

windows7-x64

8

SMTP-FGMet...78.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SMTP-FGMet32ptD1LBKpl9d-c5baf9b10bb63f546bf7d153f7d50c78.doc

  • Size

    556KB

  • Sample

    240903-hmpvha1fng

  • MD5

    c5baf9b10bb63f546bf7d153f7d50c78

  • SHA1

    1fb83f290da89601642efb47731f3ae5e6f204b5

  • SHA256

    ce76f02cf57092e33b1daf8a41af4b3d2804a9579e801644318dca35af842d54

  • SHA512

    19cdc68feb78e35e72ee01f83e69cc61855ae5521fb5265bb9249c3f7eff1722b09d720243d3c527bbda02c5390086aeffc0b5485cded0356c037bd9dd23a211

  • SSDEEP

    12288:5+xWSu1Cq113pE2DvTlEZ4E0/Pygf2eSoPvIHBUTtp:5UW1Cqz3/K4E0/qYSoPvISv

Score
10/10
defense_evasiondiscoveryexecution

Malware Config

Targets

    • Target

      SMTP-FGMet32ptD1LBKpl9d-c5baf9b10bb63f546bf7d153f7d50c78.doc

    • Size

      556KB

    • MD5

      c5baf9b10bb63f546bf7d153f7d50c78

    • SHA1

      1fb83f290da89601642efb47731f3ae5e6f204b5

    • SHA256

      ce76f02cf57092e33b1daf8a41af4b3d2804a9579e801644318dca35af842d54

    • SHA512

      19cdc68feb78e35e72ee01f83e69cc61855ae5521fb5265bb9249c3f7eff1722b09d720243d3c527bbda02c5390086aeffc0b5485cded0356c037bd9dd23a211

    • SSDEEP

      12288:5+xWSu1Cq113pE2DvTlEZ4E0/Pygf2eSoPvIHBUTtp:5UW1Cqz3/K4E0/qYSoPvISv

    Score
    10/10
    defense_evasiondiscoveryexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Evasion via Device Credential Deployment

      defense_evasionexecution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks