2019-09-17 21:35:44 +00:00
|
|
|
## Table of Contents
|
|
|
|
|
* [Malware analysis](#Malware-analysis)
|
|
|
|
|
+ [Initial vector](#Initial-vector)
|
|
|
|
|
* [Cyber Threat Intel](#Cyber-Threat-Intel)
|
|
|
|
|
* [Indicators Of Compromise (IOC)](#IOC)
|
|
|
|
|
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
|
|
|
|
|
* [Links](#Links)
|
|
|
|
|
+ [Original Tweet](#Original-Tweet)
|
|
|
|
|
+ [Link Anyrun](#Links-Anyrun)
|
|
|
|
|
+ [Documents](#Documents)
|
|
|
|
|
|
|
|
|
|
## Malware analysis <a name="Malware-analysis"></a>
|
|
|
|
|
### Initial vector <a name="Initial-vector"></a>
|
|
|
|
|
###### The initial vector
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Cyber kill chain <a name="Cyber-kill-chain"></a>
|
|
|
|
|
###### The process graph resume the cyber kill chain used by the attacker.
|
|
|
|
|
![alt text]()
|
|
|
|
|
## Cyber Threat Intel <a name="Cyber-Threat-Intel"></a>
|
|
|
|
|
## References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a>
|
|
|
|
|
###### List of all the references with MITRE ATT&CK Matrix
|
|
|
|
|
|
|
|
|
|
|Enterprise tactics|Technics used|Ref URL|
|
|
|
|
|
| :---------------: |:-------------| :------------- |
|
|
|
|
|
||||
|
|
|
|
|
||||
|
|
|
|
|
||||
|
|
|
|
|
|
|
|
|
|
## Indicators Of Compromise (IOC) <a name="IOC"></a>
|
|
|
|
|
|
|
|
|
|
###### List of all the Indicators Of Compromise (IOC)
|
|
|
|
|
|
|
|
|
|
| Indicator | Description|
|
|
|
|
|
| ------------- |:-------------:|
|
|
|
|
|
|||
|
|
|
|
|
||Domain requested|
|
|
|
|
|
||IP requested|
|
|
|
|
|
||HTTP/HTTPS requests||
|
|
|
|
|
||IP C2|
|
|
|
|
|
||Domain C2|
|
|
|
|
|
###### This can be exported as JSON format [Export in JSON]()
|
|
|
|
|
|
|
|
|
|
## Links <a name="Links"></a>
|
|
|
|
|
###### Original tweet: [https://twitter.com/Timele9527/status/1173431630171492352](https://twitter.com/Timele9527/status/1173431630171492352) <a name="Original-Tweet"></a>
|
|
|
|
|
###### Links Anyrun: <a name="Links-Anyrun"></a>
|
2019-09-17 23:09:38 +00:00
|
|
|
* [86ccedaa93743e83787f53e09e376713](https://app.any.run/tasks/0df3deaf-e8e9-4b23-8b64-fed49b85811f)
|
|
|
|
|
* [d2263c15dfcccfef16ecf1c1c9304064befddf49cdbbd40abd12513481d7faf7.doc](https://app.any.run/tasks/63251738-19fb-4155-ae23-0a8d4d780682)
|
|
|
|
|
* [
|
|
|
|
|
01d85719c5fec354431881f304307bb5521ecf6cb50eec4d3ec40d103dd3d3ae.docx](https://app.any.run/tasks/43bb63ce-4c78-4c1c-ae1d-a85b0106d983)
|
|
|
|
|
* [17e3a134ee4bcb50a9f608409853628ac619fd24cffd8d15868cf96ce63bb775.doc](https://app.any.run/tasks/e194a69c-9e4e-4c7b-9e73-f6b144af95e1)
|
|
|
|
|
* [A1719.docx](https://app.any.run/tasks/524aff0c-2f82-4f03-8ad0-16928adcf1f2)
|
|
|
|
|
* [57ecda52cfb12afa08e84fe86cd61a95.zip](https://app.any.run/tasks/411a27d8-9b47-4f87-bd06-35d813ab1457)
|
|
|
|
|
* [Scan0012.docx](https://app.any.run/tasks/f3397ba6-f8a0-46c5-b40f-f91bdfddc5db)
|
2019-09-17 21:35:44 +00:00
|
|
|
###### Documents: <a name="Documents"></a>
|
|
|
|
|
* [link]()
|
