Overview

overview

10

Static

static

8

Document_1...py.xls

windows7_x64

10

Document_1...py.xls

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ccc14f2bab2e9eb1d7228e225afda558fd4b52ed670303a912ace1984b35b06

  • Size

    19KB

  • Sample

    210114-3mpd6jscqn

  • MD5

    7e233554c276988f2bde5c6d52ee180e

  • SHA1

    a515688ce5655db73a164bf471d5c92e75a4e0a7

  • SHA256

    2ccc14f2bab2e9eb1d7228e225afda558fd4b52ed670303a912ace1984b35b06

  • SHA512

    a78002121587b8fe725e06215cd31b84010088e54f6199d2b360e31d17beb0fb9572b3e20a01866d23d6019e017e1825a4eb7d66770a24b28391a05b524eb8ec

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      Document_1204350147-Copy.xls

    • Size

      43KB

    • MD5

      651725c61d1aee1946d7b748d0ec5afa

    • SHA1

      85b35fdbcda8a15fc3fda26874d5dcdbafeee995

    • SHA256

      adad807fa22f398e0a40396ed65d0827f9f14baf7e1281b713dfb17e2683d743

    • SHA512

      129c92d4e4b14cd1bf88e310771a387d11566b074881521792f262fa62a450ab593d53e021efed210223bae4ce458cfcaa413a18e544e25a9481b05b2cb76ee5

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks