Overview

overview

10

Static

static

8

document-1...90.xls

windows7_x64

10

document-1...90.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-1471350090.xls

  • Size

    332KB

  • Sample

    201126-ynp8v58wpx

  • MD5

    b6a5fe62acf2c7861d6097f37038b57a

  • SHA1

    12457a5149bd27d6894d963d52c70db209b54201

  • SHA256

    b79f08abf7ea8e72407cfd8e5d64fd8a138e36cc94bf8a249b12155c81aa0310

  • SHA512

    993b16d72dee075ef96852c399694a80616146260c71051e0e63db99e83264d82e09024fef0be04c93657079183cdf63d5742775496e99ac57fa51d7f6780c36

Score
10/10
macro

Malware Config

Targets

    • Target

      document-1471350090.xls

    • Size

      332KB

    • MD5

      b6a5fe62acf2c7861d6097f37038b57a

    • SHA1

      12457a5149bd27d6894d963d52c70db209b54201

    • SHA256

      b79f08abf7ea8e72407cfd8e5d64fd8a138e36cc94bf8a249b12155c81aa0310

    • SHA512

      993b16d72dee075ef96852c399694a80616146260c71051e0e63db99e83264d82e09024fef0be04c93657079183cdf63d5742775496e99ac57fa51d7f6780c36

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks