Overview

overview

10

Static

static

8

inv_8.xls

windows7_x64

6

inv_8.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    inv_8.xls

  • Size

    603KB

  • Sample

    200717-pznh2lvktj

  • MD5

    37f53b3c355374800e2766f86a4fb029

  • SHA1

    4bc459dad806e86dcedb183e60ba891e20d0bea7

  • SHA256

    a4c76c4969af9211c5ae6e6d0942971b0b7b4e0fb2a4b47e45e77231ea22a5ab

  • SHA512

    d9e0ee28afa96f4ca897f9a2c7f6248ee83decf11777e91302b0b0481a00e51963b14802f1f36618dd7c3def10020877ff5c2942249154c3011887da7d95a6fa

Score
10/10
macro

Malware Config

Targets

    • Target

      inv_8.xls

    • Size

      603KB

    • MD5

      37f53b3c355374800e2766f86a4fb029

    • SHA1

      4bc459dad806e86dcedb183e60ba891e20d0bea7

    • SHA256

      a4c76c4969af9211c5ae6e6d0942971b0b7b4e0fb2a4b47e45e77231ea22a5ab

    • SHA512

      d9e0ee28afa96f4ca897f9a2c7f6248ee83decf11777e91302b0b0481a00e51963b14802f1f36618dd7c3def10020877ff5c2942249154c3011887da7d95a6fa

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Enumerates connected drives

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks