Overview

overview

10

Static

static

8

Cancellati...21.xls

windows7_x64

10

Cancellati...21.xls

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cancellation-1703335649-03112021.xls

  • Size

    277KB

  • Sample

    210312-4g3yy3plje

  • MD5

    3281913b5459f992a8dfbe689d83bbca

  • SHA1

    1572bd002d688ff643444210cbccb166e54e03e6

  • SHA256

    0426b34a070c38ee081e1aa0388e113d2af3ce10fbf1529a1008e7776eceb5f7

  • SHA512

    d5feadf51d6cf82ba159bae5ec89c7b3234093894de2ae6c9ebdb6a5dbc0913bca3cc515fb5a64496e8dfcde0fc8e4daeb7887482a6f4b48f0788a8eb68dd4d8

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://195.123.220.67/44267.0222421296.dat
xlm40.dropper

http://45.150.67.127/44267.0222421296.dat

Targets

    • Target

      Cancellation-1703335649-03112021.xls

    • Size

      277KB

    • MD5

      3281913b5459f992a8dfbe689d83bbca

    • SHA1

      1572bd002d688ff643444210cbccb166e54e03e6

    • SHA256

      0426b34a070c38ee081e1aa0388e113d2af3ce10fbf1529a1008e7776eceb5f7

    • SHA512

      d5feadf51d6cf82ba159bae5ec89c7b3234093894de2ae6c9ebdb6a5dbc0913bca3cc515fb5a64496e8dfcde0fc8e4daeb7887482a6f4b48f0788a8eb68dd4d8

    Score
    10/10
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks