Overview

overview

10

Static

static

8

ed947ced26...27.xls

windows7_x64

10

ed947ced26...27.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed947ced26fd52461dc961b0d28d9027.xls

  • Size

    143KB

  • Sample

    210224-r4cp2v6qya

  • MD5

    ed947ced26fd52461dc961b0d28d9027

  • SHA1

    8e2dec363c3381e86f3cee6e023fbd18f954d927

  • SHA256

    20c1ce4e2f46fe2a27a60693509dc9d25cee3fe7c49712b92ffd60e57e656bb6

  • SHA512

    9bc98671970a148df679b3ed66d3ac9758cbe5229bccd7dfa3ba6e7a5d1bf8b27308eca0610e9f87111cf1360816139270df8f7fb419b0340fb955da33042379

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://dindorf.com.ar/ntpnttfypqs/44251459551041700000.dat
xlm40.dropper

http://7ruzezendegi.com/samsgtlfwzt/44251459551041700000.dat
xlm40.dropper

http://miaovideo.com/wwdtfgdlijlr/ 44251459551041700000.dat
xlm40.dropper

http://batikentklinik.com/qtuofsxtov/44251459551041700000.dat
xlm40.dropper

http://chandni.pk/ictrljsfuh/44251459551041700000.dat

Targets

    • Target

      ed947ced26fd52461dc961b0d28d9027.xls

    • Size

      143KB

    • MD5

      ed947ced26fd52461dc961b0d28d9027

    • SHA1

      8e2dec363c3381e86f3cee6e023fbd18f954d927

    • SHA256

      20c1ce4e2f46fe2a27a60693509dc9d25cee3fe7c49712b92ffd60e57e656bb6

    • SHA512

      9bc98671970a148df679b3ed66d3ac9758cbe5229bccd7dfa3ba6e7a5d1bf8b27308eca0610e9f87111cf1360816139270df8f7fb419b0340fb955da33042379

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks