Overview

overview

10

Static

static

8

info_cl.7572.xls

windows7_x64

10

info_cl.7572.xls

windows10_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    info_cl.7572.xls

  • Size

    31KB

  • Sample

    210120-htj4aexvbe

  • MD5

    70e243c4f55f410fcd73d22708409176

  • SHA1

    6a6c46cf50615e58a8fe8ef78231752a1323754b

  • SHA256

    0be53050492d8c9cecc16b522054270f6c9a965a2f2f63704492e1836e285ddb

  • SHA512

    0fd6ed9065b369f35886e464f78dbfcf00c7c8b63116e7e6a70802a209e11a4492160907474001f837485af1781369cd4ff8dcf2665740488a8fd58c96f16b92

Score
10/10
macroransomwarexlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://ezucycam.com/k.php

Targets

    • Target

      info_cl.7572.xls

    • Size

      31KB

    • MD5

      70e243c4f55f410fcd73d22708409176

    • SHA1

      6a6c46cf50615e58a8fe8ef78231752a1323754b

    • SHA256

      0be53050492d8c9cecc16b522054270f6c9a965a2f2f63704492e1836e285ddb

    • SHA512

      0fd6ed9065b369f35886e464f78dbfcf00c7c8b63116e7e6a70802a209e11a4492160907474001f837485af1781369cd4ff8dcf2665740488a8fd58c96f16b92

    Score
    10/10
    ransomware

    • JavaScript code in executable

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks