Overview

overview

10

Static

static

8

galadriel

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    maybeice.xlsb.zip

  • Size

    72KB

  • Sample

    210115-bz7lh7c8es

  • MD5

    6541ad46f965b8e595b7224505a1d38c

  • SHA1

    9b607c6fe680384a73a2c49387bda07589ad3eec

  • SHA256

    cb5d39fc99ebffb2e137104b493ca9102630698a49e6a1a35d0f7a84b01244f6

  • SHA512

    637e8a620e0c57882ab65b0b96295d2be72c5c994cebbf20f2e143decf85758bab3fec274b8687690eb2048105a85a5c5c1df9bedeb4ed9049e2ed86231add82

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source

Targets

    • Target

      maybeice.xlsb

    • Size

      80KB

    • MD5

      79f07a91462a30ffd08e5d5df0b818f4

    • SHA1

      c257b63ed7184c9da9c59318f927a9c948d88261

    • SHA256

      547477332bd0dde997b697e6f74110ff4af5b41ad0d71dee3d3f51d4c3db3bc5

    • SHA512

      f87242140303ff78e38c642af7416deb078781af3864f7e52b5867f8a792437d48478d169ec291947290515d9d5ba92b8dd92821dcbbaa049e0b66f87ff322a2

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks