Overview

overview

10

Static

static

8

SecuriteIn...68.doc

windows7_x64

10

SecuriteIn...68.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.W97M.Downloader.3758.22468

  • Size

    39KB

  • Sample

    200701-ck73ktd522

  • MD5

    205b4d4b93e744d9ae520b62e98c7619

  • SHA1

    688752c9a25d28e3533cc98b37d98bc688614207

  • SHA256

    61c7eb8c33d7eb01285c503fa72d249f470fe3606ff10e459cfdc2f9e3d59b35

  • SHA512

    40d3d3a4b4b8944ec6546888bd1599945c5b558c7edcc24cdd0dc30f9331b1396d68e34eb5a43f5c38e60b24ad97b67c065722c1b462d4971f5b1e7e7143038c

Score
10/10
macro

Malware Config

Targets

    • Target

      SecuriteInfo.com.W97M.Downloader.3758.22468

    • Size

      39KB

    • MD5

      205b4d4b93e744d9ae520b62e98c7619

    • SHA1

      688752c9a25d28e3533cc98b37d98bc688614207

    • SHA256

      61c7eb8c33d7eb01285c503fa72d249f470fe3606ff10e459cfdc2f9e3d59b35

    • SHA512

      40d3d3a4b4b8944ec6546888bd1599945c5b558c7edcc24cdd0dc30f9331b1396d68e34eb5a43f5c38e60b24ad97b67c065722c1b462d4971f5b1e7e7143038c

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

BITS Jobs

1
T1197

Privilege Escalation

Defense Evasion

BITS Jobs

1
T1197

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks