Overview

overview

10

Static

static

8

Proforma Invoice.xlsm

windows7_x64

10

Proforma Invoice.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Proforma Invoice.xlsm

  • Size

    384KB

  • Sample

    210308-rhzs8hvh22

  • MD5

    109177afb0904ec548f459fdfde1a928

  • SHA1

    f5b73b1d34fc08f695ed4be8b15a33a12dddcc9a

  • SHA256

    289fd8d06a0809ace139201a7bd5896eecc684f0887e791f307e47bbfa5698e4

  • SHA512

    8ab237baebb6958e9ebb6ab482252800b5977d41ffcca105f9077144f49199651828ee9a437fcc820873daeabce8897ffa7563c2d979a7d5c2420f3635aad405

Score
10/10
macropyinstaller

Malware Config

Targets

    • Target

      Proforma Invoice.xlsm

    • Size

      384KB

    • MD5

      109177afb0904ec548f459fdfde1a928

    • SHA1

      f5b73b1d34fc08f695ed4be8b15a33a12dddcc9a

    • SHA256

      289fd8d06a0809ace139201a7bd5896eecc684f0887e791f307e47bbfa5698e4

    • SHA512

      8ab237baebb6958e9ebb6ab482252800b5977d41ffcca105f9077144f49199651828ee9a437fcc820873daeabce8897ffa7563c2d979a7d5c2420f3635aad405

    Score
    10/10
    pyinstaller

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks