Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
CVE-2017-0199 – Old Flaws New Techniques
Threat Actors
Excerpt
An exploit is a malicious program that takes advantage of a software vulnerability that may enable a remote attacker to gain access to the targeted system. In this article, we are going to discuss the CVE-2017-0199 exploit campaign. Execution Flow Source: socinvestigation.com Here, the exploit arrives as a spear-phishing email attachment. This kind of email contains Microsoft office word documents (.docx) or sometimes with password-protected archives format attachments. Also…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2017-0199 | Medium | Score 56/100 | First seen |
| MD5 | 2c22414f50dd46dadca71add23d98046 | Medium | Score 53/100 | First seen |
| MD5 | d5ef9a5ee8c65d347913d486d32d1768 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…