Overview

overview

10

Static

static

8

Debt-Detai...21.xls

windows7_x64

10

Debt-Detai...21.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Debt-Details-882555669-03052021.zip

  • Size

    13KB

  • Sample

    210305-wpzzl4emrx

  • MD5

    6c86e1a62406dcd7e269d1fd09f20216

  • SHA1

    65e9509822f547ad942575b59ddf765b3361f858

  • SHA256

    621cfcf91513bcb031c7233c963276ffc41c65c63d28a278c2f23c3ce555c724

  • SHA512

    0ee00f423c882213243b902458dfd9ccae815af6b3ea4df8759b735ac91d7a850b282d69d4c57c6f2e08e0d31cbd3c2d5e308ec1bbaa0a0e9baf6962ca2bcb20

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://kosherbansko.com/vozrhzftc/44260.8131115741.dat
xlm40.dropper

http://beautyhair.by/rkqhopvrb/44260.8131115741.dat
xlm40.dropper

http://trysaileggplants.com/xbbomazcknz/44260.8131115741.dat
xlm40.dropper

http://giftcard16.com/pghxph/44260.8131115741.dat
xlm40.dropper

http://www.ausfencing.org/jqikucbefrth/44260.8131115741.dat

Targets

    • Target

      Debt-Details-882555669-03052021.xls

    • Size

      78KB

    • MD5

      8c0c2124df5a468660e1e3f46c02e799

    • SHA1

      69a023154d3e5c320936c8b52274b8e68f2a447d

    • SHA256

      352a9b33582af4ab295bd7f5077761219b8cffc4d1a831d518d5b5a365c88629

    • SHA512

      9e8141ffab10d13a6c11636716fd7c81e37d9c5abacad3966f275f534593a0987af3e68af28c840a85b98f276c7a9425b263605853b11541a9fee9863e83ec4f

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks