Overview

overview

10

Static

static

8

Complaint-...21.xls

windows7_x64

10

Complaint-...21.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Complaint-Copy-684082724-03092021.xls

  • Size

    82KB

  • Sample

    210309-j8656q3cq6

  • MD5

    c2da76a03a3690b5135a53312153e14e

  • SHA1

    869f08157b4874014e48f47a64cb5d4244037e13

  • SHA256

    70aa95576da74ef8c6d76af64cf4125e8a5fb9a59a58f60e714962c8f60898d2

  • SHA512

    fa3191fdc561885b5d8f197d089e4fd8d3257b6a146275d58dae936b304e970216f65b2a0fe163b680ad5e3127e17c4395d1df8c200ba946765ddef801172e30

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://ca.jimitrangras.com/sjntt/44264.8290543981.dat
xlm40.dropper

http://pokojewewladyslawowie.pl/orlpzhiy/44264.8290543981.dat
xlm40.dropper

http://naidunews.com/ohcagctzl/44264.8290543981.dat
xlm40.dropper

http://buscocasascr.com/xqqikyc/44264.8290543981.dat
xlm40.dropper

http://follow-trader.com/haxzmg/44264.8290543981.dat

Targets

    • Target

      Complaint-Copy-684082724-03092021.xls

    • Size

      82KB

    • MD5

      c2da76a03a3690b5135a53312153e14e

    • SHA1

      869f08157b4874014e48f47a64cb5d4244037e13

    • SHA256

      70aa95576da74ef8c6d76af64cf4125e8a5fb9a59a58f60e714962c8f60898d2

    • SHA512

      fa3191fdc561885b5d8f197d089e4fd8d3257b6a146275d58dae936b304e970216f65b2a0fe163b680ad5e3127e17c4395d1df8c200ba946765ddef801172e30

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks