Overview

overview

10

Static

static

8

FFox

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation-2058593863-03112021.xls

  • Size

    277KB

  • Sample

    210311-lcvavbkqxn

  • MD5

    1994ed2e9e5434bfc187f99279ce20aa

  • SHA1

    bd104412b46878160cf24ad3f0a860614e8bf19d

  • SHA256

    b39967f49fff59a7b1d09e1a8fa52d9e11f52c51a2dd524d9077f7f30db8a51d

  • SHA512

    bbbb8746b4dda7a3b9789d9e35d7400453fa7fb2d7888cec54e8ce2cc6ca6379f20116bb03e1061060a65b2f9b215f80c57521207e5a0a3b97d2893858f87018

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      Cancellation-2058593863-03112021.xls

    • Size

      277KB

    • MD5

      1994ed2e9e5434bfc187f99279ce20aa

    • SHA1

      bd104412b46878160cf24ad3f0a860614e8bf19d

    • SHA256

      b39967f49fff59a7b1d09e1a8fa52d9e11f52c51a2dd524d9077f7f30db8a51d

    • SHA512

      bbbb8746b4dda7a3b9789d9e35d7400453fa7fb2d7888cec54e8ce2cc6ca6379f20116bb03e1061060a65b2f9b215f80c57521207e5a0a3b97d2893858f87018

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks