Exploitation for Client Execution
Dynamic Analysis Report
Created 2 years ago
Bank details.doc.rtf
RTF Document
VMRay Threat Identifiers (8 rules, 8 matches)
| Score | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
5/5 | System Modification | Modifies operating system directory | 1 | - | |
4/5 | Exploit | Exploits a vulnerability in MS Office | 1 | Exploit | |
4/5 | Network Connection | Downloads executable | 1 | Downloader | |
4/5 | Network Connection | Attempts to connect through HTTP | 1 | - | |
4/5 | Execution | Document tries to create process | 1 | - | |
4/5 | Reputation | Malicious file detected via reputation | 1 | - | |
4/5 | Reputation | Malicious host or URL detected via reputation | 1 | - | |
2/5 | Anti Analysis | Tries to detect debugger | 1 | - |
Screenshots
Monitored Processes
MITRE ATT&CK™ Matrix - Windows
ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Remote File Copy
Collection
Command and Control
Remote File Copy
Standard Application Layer Protocol
Exfiltration
Impact
Sample Information
| ID | #8608244 |
| MD5 | |
| SHA1 | |
| SHA256 | |
| SSDeep | |
| File Name | Bank details.doc.rtf |
| File Size | 89.67 KB |
| Sample Type | RTF Document |
| Has Macros |
Analysis Information
| Creation Time | 2023-08-15 06:08 (UTC+) |
| Analysis Duration | 00:04:03 |
| Termination Reason | Timeout |
| Number of Monitored Processes | 3 |
| Execution Successful | |
| Reputation Enabled | |
| Built-in AV Enabled | |
| Number of AV Matches | 0 |
| YARA Enabled | |
| Number of YARA Matches | 0 |
