Overview

overview

8

Static

static

8

IRS_form_3690735.xls

windows7_x64

6

IRS_form_3690735.xls

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IRS_form_3690735.xls

  • Size

    78KB

  • Sample

    200708-azm995cqja

  • MD5

    85d0e857f338ce777927f0e3fda149d5

  • SHA1

    88d866392071f68237bbf46110c9d20f5c5eb9f7

  • SHA256

    7e3638d120694383935bb8b66f6e20fd9cfb2902d7865a4d8eb6d751175579ba

  • SHA512

    74b5c8c8dbf7eef921da24e95059a13a0944e8f8df1429e0734b6fb9bc179890c5c197d5a31fbe379183917da04f986718c41c4b5db9cb8c65fe34a43a3d727f

Score
8/10
macro

Malware Config

Targets

    • Target

      IRS_form_3690735.xls

    • Size

      78KB

    • MD5

      85d0e857f338ce777927f0e3fda149d5

    • SHA1

      88d866392071f68237bbf46110c9d20f5c5eb9f7

    • SHA256

      7e3638d120694383935bb8b66f6e20fd9cfb2902d7865a4d8eb6d751175579ba

    • SHA512

      74b5c8c8dbf7eef921da24e95059a13a0944e8f8df1429e0734b6fb9bc179890c5c197d5a31fbe379183917da04f986718c41c4b5db9cb8c65fe34a43a3d727f

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks