Overview

overview

10

Static

static

8

Calculatio...20.xls

windows7_x64

10

Calculatio...20.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Calculation-1905798087-11202020.xls

  • Size

    61KB

  • Sample

    201125-wd7mw7qjhx

  • MD5

    d2ccb220ebd1726027a94b8e55f7ea57

  • SHA1

    8863bcc3dce81b2c0fa34c9d5c25bad443159597

  • SHA256

    89ef9b418bfd698c45ec3caac3067d0fb155118de909362afe9dd811f41094ec

  • SHA512

    23964e20b805c840877fd8e4c9f340971f9ea6b7db4d0237590dded6d83753bef77e31f7f2b8398eaeee800ca21f3ead5fc49f45e26d7d349e23a596fff74773

Score
10/10
cryptonemacropacker

Malware Config

Targets

    • Target

      Calculation-1905798087-11202020.xls

    • Size

      61KB

    • MD5

      d2ccb220ebd1726027a94b8e55f7ea57

    • SHA1

      8863bcc3dce81b2c0fa34c9d5c25bad443159597

    • SHA256

      89ef9b418bfd698c45ec3caac3067d0fb155118de909362afe9dd811f41094ec

    • SHA512

      23964e20b805c840877fd8e4c9f340971f9ea6b7db4d0237590dded6d83753bef77e31f7f2b8398eaeee800ca21f3ead5fc49f45e26d7d349e23a596fff74773

    Score
    10/10
    cryptonepacker

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks