Overview

overview

10

Static

static

8

Invoice_0565943.xls

windows7_x64

10

Invoice_0565943.xls

windows10_x64

10

Resubmissions

21-02-2021 08:21

210221-rl1t1aatqa 10

17-02-2021 09:16

210217-4cyttz4b1j 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice_0565943.xls

  • Size

    266KB

  • Sample

    210217-4cyttz4b1j

  • MD5

    f6af4458d269a660cedc88ff8738d4ce

  • SHA1

    d7350d7195c73a9489b3c27d62407e2c8f34825d

  • SHA256

    05b0a29f16f196a36944c94487032c1d9b9acc6bee8839457d730f4053f68e29

  • SHA512

    b24c6105017b8cb0f90c45e6c89838ae58521b285750a3f315ad80dc15a422ca41bab69ca87fa80aaef2901c60f186351bf09022872880c8ed9112a97817dd0c

Score
10/10
macrovmprotectxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://forcemc.digital/image/v

Targets

    • Target

      Invoice_0565943.xls

    • Size

      266KB

    • MD5

      f6af4458d269a660cedc88ff8738d4ce

    • SHA1

      d7350d7195c73a9489b3c27d62407e2c8f34825d

    • SHA256

      05b0a29f16f196a36944c94487032c1d9b9acc6bee8839457d730f4053f68e29

    • SHA512

      b24c6105017b8cb0f90c45e6c89838ae58521b285750a3f315ad80dc15a422ca41bab69ca87fa80aaef2901c60f186351bf09022872880c8ed9112a97817dd0c

    Score
    10/10
    vmprotect

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks