Overview

overview

8

Static

static

8

11182140512.xls

windows7_x64

6

11182140512.xls

windows10_x64

8

Resubmissions

17-12-2020 17:27

201217-zn5dhd2f8s 10

22-09-2020 07:26

200922-drz7628cca 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11182140512.xls

  • Size

    103KB

  • Sample

    200922-drz7628cca

  • MD5

    fcca012018f8aa9fbfeb705664a5db2b

  • SHA1

    71123bd3c44bc29a49f4e65d14bc5e52c52927c2

  • SHA256

    f726cbe23062b21e3eee285a2fb0d3b8d86bcf918b2b52c32f4949a86f66514e

  • SHA512

    09fb53f13b8a35ff107d6f0781db9efceb60b597d520544a88159cdaaa43cd7afbac6230d8ab0d25164b4441e57fae9b55c13cd0be08d83482d319886ec1b5f1

Score
8/10
macro

Malware Config

Targets

    • Target

      11182140512.xls

    • Size

      103KB

    • MD5

      fcca012018f8aa9fbfeb705664a5db2b

    • SHA1

      71123bd3c44bc29a49f4e65d14bc5e52c52927c2

    • SHA256

      f726cbe23062b21e3eee285a2fb0d3b8d86bcf918b2b52c32f4949a86f66514e

    • SHA512

      09fb53f13b8a35ff107d6f0781db9efceb60b597d520544a88159cdaaa43cd7afbac6230d8ab0d25164b4441e57fae9b55c13cd0be08d83482d319886ec1b5f1

    Score
    8/10

    • Executes dropped EXE

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks