Overview

overview

10

Static

static

file.doc

windows7_x64

10

file.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.doc

  • Size

    73KB

  • Sample

    200529-f38xkv4v12

  • MD5

    03da3c149defc051b11005c86bcbe599

  • SHA1

    f95da4f19e6a289a4719415d24f1d32275761a33

  • SHA256

    f7c5c10cee118eddd6c5a20c5a095032324fcb0bd368d7b7015f6646d8b5d411

  • SHA512

    2d09399255220372db0e0497f0f0c0957ce5211bbe079b5999caa6a49046086461784f685811728050b992d3c7af9b7a5c9f4069c7f20828a9e38a2136d80db4

Score
10/10

Malware Config

Targets

    • Target

      file.doc

    • Size

      73KB

    • MD5

      03da3c149defc051b11005c86bcbe599

    • SHA1

      f95da4f19e6a289a4719415d24f1d32275761a33

    • SHA256

      f7c5c10cee118eddd6c5a20c5a095032324fcb0bd368d7b7015f6646d8b5d411

    • SHA512

      2d09399255220372db0e0497f0f0c0957ce5211bbe079b5999caa6a49046086461784f685811728050b992d3c7af9b7a5c9f4069c7f20828a9e38a2136d80db4

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks