Overview

overview

8

Static

static

8

account_in...18.xls

windows7_x64

6

account_in...18.xls

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    account_invoice_5918.xls

  • Size

    166KB

  • Sample

    200709-kyy4w4hana

  • MD5

    a13b46e0c9153d4ce366ad65c4d2fc04

  • SHA1

    bd1c268034ab18a61ef5bb2f4c75de70fd739124

  • SHA256

    56754abf3731d99b740618119f73736894c6aba81fde45ee27f864f10b376341

  • SHA512

    54cfc04fe000011ea8ecc12988dfa9b4f572093d187a5bc3473333ae142990130165bbf71a5b1751ab454f40535eb2d8ce01d642cffb5f22646b79411fb5a40f

Score
8/10
macro

Malware Config

Targets

    • Target

      account_invoice_5918.xls

    • Size

      166KB

    • MD5

      a13b46e0c9153d4ce366ad65c4d2fc04

    • SHA1

      bd1c268034ab18a61ef5bb2f4c75de70fd739124

    • SHA256

      56754abf3731d99b740618119f73736894c6aba81fde45ee27f864f10b376341

    • SHA512

      54cfc04fe000011ea8ecc12988dfa9b4f572093d187a5bc3473333ae142990130165bbf71a5b1751ab454f40535eb2d8ce01d642cffb5f22646b79411fb5a40f

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks