Overview

overview

10

Static

static

PO 195.xlsx

windows7_x64

10

PO 195.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 195.xlsx

  • Size

    2.5MB

  • Sample

    210201-ac47yn5eax

  • MD5

    3a1621af2954f670e033b8dd2d60be90

  • SHA1

    7602d64ababdf9ba09ef1eb82e2b526e209eebad

  • SHA256

    04a55a28634ec378d53535f2c105b0c4245d6fe83182101fa3b84cec806690c9

  • SHA512

    62f1314b52b9ce46a28c2bace233bdecb6c6f33588df08668abb59db38539ad97bc8060826fd3e47b666fa5072c20f217e2e372f14b58c9f46347506c6548efa

Score
10/10
nanocoreevasionkeyloggerransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      PO 195.xlsx

    • Size

      2.5MB

    • MD5

      3a1621af2954f670e033b8dd2d60be90

    • SHA1

      7602d64ababdf9ba09ef1eb82e2b526e209eebad

    • SHA256

      04a55a28634ec378d53535f2c105b0c4245d6fe83182101fa3b84cec806690c9

    • SHA512

      62f1314b52b9ce46a28c2bace233bdecb6c6f33588df08668abb59db38539ad97bc8060826fd3e47b666fa5072c20f217e2e372f14b58c9f46347506c6548efa

    Score
    10/10
    nanocoreevasionkeyloggerransomwarespywarestealertrojan

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks