Overview

overview

10

Static

static

8

document-3...81.xls

windows7_x64

10

document-3...81.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    _attached_file (63).zip

  • Size

    15KB

  • Sample

    210225-632rd2hjax

  • MD5

    4844f9c7067335cb5f23c9529db9b475

  • SHA1

    5c4ef4f396d768b9a494bf5b53e0c1f79f9ca6f6

  • SHA256

    ad8de2f4b2d66758a5aef76c393d3f456e0199d789ee6eec06422cd76b91ddd2

  • SHA512

    3a66bc3f3620bfadd2e1124d4f008ccc23c03403d2e8bd5061df87b70449d99fcf43bcfcb6122ee2d14422b535bc0ac44c5f65c337089010dae0bedf8298cbd3

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://45.11.183.252/22.gif

Targets

    • Target

      document-357925881.xls

    • Size

      90KB

    • MD5

      7e8de93e7c595ed3f0e9f88441f21f35

    • SHA1

      05528807c5a5df282bae695adbe546702d42ccc6

    • SHA256

      5bb5d73b43557fabe5887a9e6964c43d309135d52bca37d4b76d15c8d787da03

    • SHA512

      6683de3a933bf503a49ad7d37c18236ed14bae334bc8ecbe92405a9e443d75ac94f340f34cf5caf535d6b22b18770bb8432a247dfc704b6006c8d30c73ebc275

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks