Overview

overview

8

Static

static

8

W2_tax.xls

windows7_x64

6

W2_tax.xls

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    W2_tax.xls

  • Size

    78KB

  • Sample

    200709-51sge4tcm2

  • MD5

    1fd2f585ce9317cb4ef6e4c233ada13d

  • SHA1

    3357e3ea80149ca4e70d3d2ff1a362c8c7bd2c9d

  • SHA256

    a29c5c74a10ecc2aa343ec8da39c2549ceaad1f6d1cd7a2b1ddaf8f15d913c2c

  • SHA512

    0e90c2855aa6b815c5caf1c6f83c2bf1dd7d590a92744f90627383c6376a59ea38b5dd1d093c74e40a9a93d662c437de10201c9b85e671ba3a6145df2482184c

Score
8/10
macro

Malware Config

Targets

    • Target

      W2_tax.xls

    • Size

      78KB

    • MD5

      1fd2f585ce9317cb4ef6e4c233ada13d

    • SHA1

      3357e3ea80149ca4e70d3d2ff1a362c8c7bd2c9d

    • SHA256

      a29c5c74a10ecc2aa343ec8da39c2549ceaad1f6d1cd7a2b1ddaf8f15d913c2c

    • SHA512

      0e90c2855aa6b815c5caf1c6f83c2bf1dd7d590a92744f90627383c6376a59ea38b5dd1d093c74e40a9a93d662c437de10201c9b85e671ba3a6145df2482184c

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks