Overview

overview

10

Static

static

8-409-98186.xlsm

windows7_x64

10

8-409-98186.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8-409-98186.xlsm

  • Size

    45KB

  • Sample

    200716-nwy287e242

  • MD5

    2540aea01c233fc9be8a70a5ad3b23b1

  • SHA1

    66f7d36292484d031ebcac700230dbb4f6f3c70b

  • SHA256

    fc27d175081d94e309d0b60062c573b3975dcdcd70545f8be8af8a11ba616b96

  • SHA512

    050bd4ad6ddb06b31f7c94e674568737727521ee1db0a8ec22ce5cd176946e7e07027e5cf1469242311688862560926a777ee879367fac8ddad1142bf4b63f6f

Score
10/10

Malware Config

Targets

    • Target

      8-409-98186.xlsm

    • Size

      45KB

    • MD5

      2540aea01c233fc9be8a70a5ad3b23b1

    • SHA1

      66f7d36292484d031ebcac700230dbb4f6f3c70b

    • SHA256

      fc27d175081d94e309d0b60062c573b3975dcdcd70545f8be8af8a11ba616b96

    • SHA512

      050bd4ad6ddb06b31f7c94e674568737727521ee1db0a8ec22ce5cd176946e7e07027e5cf1469242311688862560926a777ee879367fac8ddad1142bf4b63f6f

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blacklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks