Overview

overview

10

Static

static

8

document-1...29.xls

windows7_x64

10

document-1...29.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    found (32).zip

  • Size

    15KB

  • Sample

    210225-1ck77hmlkx

  • MD5

    c78dfade23c1d29ed7ab9555d1b44dcd

  • SHA1

    16d9d7451ad3608df2edf54aaabb84ea7a6d3ef1

  • SHA256

    e7d85c8fb289616d100c73001d005c1949fac77e176f50c0634319f4b5ddfa65

  • SHA512

    1034b68c3d4406183e1d3be8e226e03185628922d7bf5891f54ec9e0f9564488129657083097452ca2d9d7c6006c06ffe8b4a0afb37fcbd2b915b89eb4664605

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://fb25d3add23hy.com/fb26.gif

Targets

    • Target

      document-1415780929.xls

    • Size

      88KB

    • MD5

      2033f8b45e79469be144ebc77bec3d24

    • SHA1

      ba82bfe601ed51c28201232be9158caa647aeb38

    • SHA256

      fbcb41216f9afc2f25e8d0ff5c2822eb82a3a86f6ba84f36f008f9f56e9b2e05

    • SHA512

      2e6349612e40c117d08890fca8c83889e7e708790708b332c448f820a5721cd4eeb3f4a0a7033624c76734414086c1078f74946f09a8428eabec7c30be04437e

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks