Overview

overview

10

Static

static

8

詳細情報.xlsb

windows7_x64

10

詳細情報.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20210312_id5947a33181.zip

  • Size

    145KB

  • Sample

    210312-dy3qnn9tv2

  • MD5

    f0a4608b7f7141c5ee3c6562cc0254e0

  • SHA1

    f565015f9992aeccf9b8843c7e73b42da560aaf9

  • SHA256

    cb0f408aa938bfd69056b1c1ac2ccaad0b4d4c1fabdb5e69fbe30b29dc5895cb

  • SHA512

    0f11c11a483792e78b36b5781e154b787e3477f1b4b7eeab173d18d73b358416f43dcc15e80c3ae560342eb1d4f70d038810d3ea12e72231ef7029af4d53e8c1

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source

Targets

    • Target

      詳細情報.xlsb

    • Size

      153KB

    • MD5

      cb5a37aac155775daed9abcfd680f39c

    • SHA1

      75cfc87fe3f6f517e684729a558358fd5d492599

    • SHA256

      426edb65615875c5f8fd31118142f0b3d2e29b360a7995d69d58803e61c1f81e

    • SHA512

      cd12773f8a606b0e04e7e02f4b8f1abab1c8efb13008ee6134771954c857f32df6dfd7f74b5a43d206eae40ceac4219e09910c22918a02f2a57e95f747d9b39f

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks