LetsDefend Tour - Case Management

Case Management

Case Management - LetsDefend

EventID: 93 - [SOC146 - Phishing Mail Detected - Excel 4.0 Macros]

Jun, 06, 2024, 11:32 AM

I just investigated Phishing Mail Detected incident on LetsDefend.

Phishing Mail Detected - LetsDefend

⭐ This alert was generated from a real phishing attack.

EventID :
93
Event Time :
Jun, 13, 2021, 02:13 PM
Rule :
SOC146 - Phishing Mail Detected - Excel 4.0 Macros
Level :
Security Analyst
SMTP Address :
24.213.228.54
Source Address :
trenton@tritowncomputers.com
Destination Address :
lars@letsdefend.io
E-mail Subject :
RE: Meeting Notes
Device Action :
Allowed
Show Hint

After our analysis, we've confirmed that the alert is a true positive. The email contains attachment which has malicious Office 4.0 macros, confirming it's a phishing attempt. Additionally, the attachment contains dangerous files that connect to malicious websites. As a response, the email has been promptly deleted from the Email Security platform, and all necessary actions have been taken to address the threat effectively.

Playbook Answers
Question:
Are there attachments or URLs in the email?
User answer:
Yes
Question:
Analyze Url/Attachment
User answer:
Malicious
Question:
Check If Mail Delivered to User?
User answer:
Delivered
Question:
Check If Someone Opened the Malicios File/URL?
User answer:
Opened
Playbook Note
After our analysis, we've confirmed that the alert is a true positive. The email contains attachment which has malicious Office 4.0 macros, confirming it's a phishing attempt. Additionally, the attachment contains dangerous files that connect to malicious websites. As a response, the email has been promptly deleted from the Email Security platform, and all necessary actions have been taken to address the threat effectively.
Extracted Artifacts
Value	Comment	Type
9458859abfd384f38362af01fb306f14	Malicious Attachment	MD5 Hash
nws.visionconsulting.ro	Contacted Domain	E-mail Domain
royalpalm.sparkblue.lk	Contacted Domain	E-mail Domain
trenton@tritowncomputers.com	Email Sender	URL Address