Overview

overview

10

Static

static

8

Overdue-De...21.xls

windows7_x64

10

Overdue-De...21.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Overdue-Debt-582347274-03042021.xls

  • Size

    76KB

  • Sample

    210304-9xhhded1lx

  • MD5

    785d3ecd020a7ec4959e4a676e8917b3

  • SHA1

    8c2c5d92352e36184055f0045c1cf098f309c6b1

  • SHA256

    a30a8873dd3c69398abcfec41fdd5a4805761bf1c42887edadf2e3ce56ff0865

  • SHA512

    93168d3503c59f6187d7e3685557ae4a1d58b5a15ac50375831645c902afa57efccdaa97e11256ce912f3cd9c8cb763b7ed80ce5329f94d863fdc5e9ac0687ca

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://giftcard16.com/ozdomsmm/44259.673446412.jpg
xlm40.dropper

http://www.ausfencing.org/pafmwptlztwo/44259.673446412.jpg
xlm40.dropper

http://mubasharhussain.ml/lwjiel/44259.673446412.jpg
xlm40.dropper

http://artisthub.farahasmar.com/bzdydzj/44259.673446412.jpg
xlm40.dropper

http://rrmmarketing.com/qqduill/44259.673446412.jpg

Targets

    • Target

      Overdue-Debt-582347274-03042021.xls

    • Size

      76KB

    • MD5

      785d3ecd020a7ec4959e4a676e8917b3

    • SHA1

      8c2c5d92352e36184055f0045c1cf098f309c6b1

    • SHA256

      a30a8873dd3c69398abcfec41fdd5a4805761bf1c42887edadf2e3ce56ff0865

    • SHA512

      93168d3503c59f6187d7e3685557ae4a1d58b5a15ac50375831645c902afa57efccdaa97e11256ce912f3cd9c8cb763b7ed80ce5329f94d863fdc5e9ac0687ca

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks