Resubmissions

17/12/2020, 18:27

201217-bavzn97yh210

09/11/2020, 20:55

201109-jwyhm7ya6610

General

  • Target
    faktura_18.xlsm
  • Size 95KB
  • Sample201217-bavzn97yh2
  • SHA256 3ad4819cec95571fba65855ebde66a308472c22a4c06501bfa1b1d51730572cc
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language
  • xlm4.0

Source
URLs
  • xlm40.dropper

    https://oidblueprin.at/3/str.dll

Targets

    • Target
      faktura_18.xlsm
    • Size 95KB
    • SHA256 3ad4819cec95571fba65855ebde66a308472c22a4c06501bfa1b1d51730572cc
    • MD5 SHA1 SHA512
    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks