Overview

overview

10

Static

static

8

002509.docm

windows10-2004-x64

6

002509.docm

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    002509.zip
  • Size 55KB
  • Sample260913-ak4xmscc77
  • SHA256 23daae5257f5ec66b2915b000b2e8f1325b28a9682887449a0c7e42142bcc069
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionmacro

Malware Config

Targets

    • Target
      002509.docm
    • Size 61KB
    • SHA256 6eb92dbeba2540b9ad5073c99c9b607d28316856272d6d54d0352fd3426f12ec
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks