Overview

overview

8

Static

static

8

IRS_form_7559663.xls

windows7_x64

6

IRS_form_7559663.xls

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IRS_form_7559663.xls

  • Size

    78KB

  • Sample

    200708-g75lztptmn

  • MD5

    9dad374d4a2553733ebf424e3fde48e4

  • SHA1

    905ceab79cf08d1e66293e77fc0c7bbf9326ac69

  • SHA256

    53443315360c434457eca1626003a288924a363677a4e1ca1bbaad902f677674

  • SHA512

    8219a9cf5a80370aa30609e48f580a956874080205ee50102416e6ac8c1c27d62119dcd2e4d10edd507b890fe4a0dfe2cadfedc702fdafe379f206343ad5dbf4

Score
8/10
macro

Malware Config

Targets

    • Target

      IRS_form_7559663.xls

    • Size

      78KB

    • MD5

      9dad374d4a2553733ebf424e3fde48e4

    • SHA1

      905ceab79cf08d1e66293e77fc0c7bbf9326ac69

    • SHA256

      53443315360c434457eca1626003a288924a363677a4e1ca1bbaad902f677674

    • SHA512

      8219a9cf5a80370aa30609e48f580a956874080205ee50102416e6ac8c1c27d62119dcd2e4d10edd507b890fe4a0dfe2cadfedc702fdafe379f206343ad5dbf4

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks