General

  • Target

    https://westend61-my.sharepoint.com/:f:/g/personal/protectedlog_westend61_de/EkQ9NPt61TxFll61PvxGomkByf1EO7tMK2AcsV8c1zQXUQ?e=Io4KVX&xsdata=MDV8MDJ8c2xvcGV6Y0BzYWN5ci5jb218YzJjMjczNGE0MTZmNDI2NzA5ZjIwOGRkMDk2MzEzYzN8NjcyYmFmY2UwY2NkNDg2Nzg0MjBlOGJiOTE4NjJhZTB8MHwwfDYzODY3NzA0MzMyNjM3MzA3OXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18NjAwMDB8fHw%3d&sdata=T0VFQ2JzZUpWYXJmdk53ajdpOTdXQ3NqMloxdlkraStvQjVRYkRqN09kUT0%3d

  • Sample

    241120-re517asmak

Malware Config

Targets

    • Target

      https://westend61-my.sharepoint.com/:f:/g/personal/protectedlog_westend61_de/EkQ9NPt61TxFll61PvxGomkByf1EO7tMK2AcsV8c1zQXUQ?e=Io4KVX&xsdata=MDV8MDJ8c2xvcGV6Y0BzYWN5ci5jb218YzJjMjczNGE0MTZmNDI2NzA5ZjIwOGRkMDk2MzEzYzN8NjcyYmFmY2UwY2NkNDg2Nzg0MjBlOGJiOTE4NjJhZTB8MHwwfDYzODY3NzA0MzMyNjM3MzA3OXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18NjAwMDB8fHw%3d&sdata=T0VFQ2JzZUpWYXJmdk53ajdpOTdXQ3NqMloxdlkraStvQjVRYkRqN09kUT0%3d

    • A potential corporate email address has been identified in the URL: 05|02|[email protected]|c2c2734a416f426709f208dd096313c3|672bafce0ccd48678420e8bb91862ae0|0|0|638677043326373079|Unknown|TWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==|60000|||

    • Detected potential entity reuse from brand MICROSOFT.

    • Probable phishing domain

MITRE ATT&CK Enterprise v15

Tasks