Overview

overview

10

Static

static

8

document-1...91.xls

windows7_x64

10

document-1...91.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-1476972391.xls

  • Size

    331KB

  • Sample

    201126-kjeemcmbrs

  • MD5

    30e9f4902b65502f97b55378d26e5627

  • SHA1

    8814a302104b5302e7204bc48e3bf3d773409d27

  • SHA256

    877df35a8b1bf7869f6a9badce905395f0457eb1289e30f1af2040bde7b6b56e

  • SHA512

    23f2b8ba9c82dd31dc6b9ac408b2701859186ea97b23c88e929b55ef2108efb5dd62454e4e834e03a33ff9184001be3a3a38754e5e69912515b6b983999cfaf4

Score
10/10
macro

Malware Config

Targets

    • Target

      document-1476972391.xls

    • Size

      331KB

    • MD5

      30e9f4902b65502f97b55378d26e5627

    • SHA1

      8814a302104b5302e7204bc48e3bf3d773409d27

    • SHA256

      877df35a8b1bf7869f6a9badce905395f0457eb1289e30f1af2040bde7b6b56e

    • SHA512

      23f2b8ba9c82dd31dc6b9ac408b2701859186ea97b23c88e929b55ef2108efb5dd62454e4e834e03a33ff9184001be3a3a38754e5e69912515b6b983999cfaf4

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks