Overview

overview

10

Static

static

8

inv_9.xls

windows7_x64

6

inv_9.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    inv_9.xls

  • Size

    603KB

  • Sample

    200717-ytnp2chhda

  • MD5

    e511d5d44cf2910cb1d6245d2f3652aa

  • SHA1

    bd1addabe7755fa3116942bbc9c190c77f25c0db

  • SHA256

    4f8696a9fa832771c2e0a561ec5b12e0bde3f0afeda049c7e53ffc1b56e7bb09

  • SHA512

    16ee8ec4ad8201a39ce79b30275ef1cc9ea9299dde3005557c501e9fb89acafdf14ececf35d4afd0fe66b035f22c99be910ac997d4594112fe52a74e8654f910

Score
10/10
macro

Malware Config

Targets

    • Target

      inv_9.xls

    • Size

      603KB

    • MD5

      e511d5d44cf2910cb1d6245d2f3652aa

    • SHA1

      bd1addabe7755fa3116942bbc9c190c77f25c0db

    • SHA256

      4f8696a9fa832771c2e0a561ec5b12e0bde3f0afeda049c7e53ffc1b56e7bb09

    • SHA512

      16ee8ec4ad8201a39ce79b30275ef1cc9ea9299dde3005557c501e9fb89acafdf14ececf35d4afd0fe66b035f22c99be910ac997d4594112fe52a74e8654f910

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Enumerates connected drives

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks