Overview

overview

10

Static

static

8

document-1...92.xls

windows7_x64

10

document-1...92.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-1485961692.xls

  • Size

    331KB

  • Sample

    201126-mef6cqwvm2

  • MD5

    1be443b919784709493d58175c48e61f

  • SHA1

    ca43532d8b428ada553a4dced82c851ac95755b4

  • SHA256

    40886ee68c4aea57ccb5babf173ad7aa533c92ea4c27b2e869953744aef30172

  • SHA512

    c0a50695a20238db764ff387f6e2404e9e8f011066da228711e61d88b1467d0885b555cb72573925e194047039b33402a608c6d88390daa4aa4b4124bfb7e8f7

Score
10/10
macro

Malware Config

Targets

    • Target

      document-1485961692.xls

    • Size

      331KB

    • MD5

      1be443b919784709493d58175c48e61f

    • SHA1

      ca43532d8b428ada553a4dced82c851ac95755b4

    • SHA256

      40886ee68c4aea57ccb5babf173ad7aa533c92ea4c27b2e869953744aef30172

    • SHA512

      c0a50695a20238db764ff387f6e2404e9e8f011066da228711e61d88b1467d0885b555cb72573925e194047039b33402a608c6d88390daa4aa4b4124bfb7e8f7

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks