Overview

overview

10

Static

static

8

document-1...83.xls

windows7_x64

10

document-1...83.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    _attached_file (69).zip

  • Size

    33KB

  • Sample

    210312-zwgck6dbea

  • MD5

    53f28c50b099924a0b3d14bed2df9c40

  • SHA1

    a083b95b09d557d08b5a4d6e4a015586f0e0ee74

  • SHA256

    c35e8908da0622915b8aa29c85e7782eb5017e2431d6302ebe31f19ee557066c

  • SHA512

    bf535e322607a056232f241f193148b9e19e2337ae9d169be05bb0e44f97821a56a83a8d0881f7d43eb29fa7426182a393d51187bbae0988a0f975fd39ac953d

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://bqx12lnjk03rrdio.xyz/i.gif

Targets

    • Target

      document-1775529683.xls

    • Size

      138KB

    • MD5

      d90e1e2487d95b60d6a00af6bf809d1c

    • SHA1

      e805ab11c60f76f1497f04897a76f69d678bcc0c

    • SHA256

      8682fa4786c1c04d5fdd0b33ed9552457a1225badd60301fd649262f0daa7b7a

    • SHA512

      acf2a7c8fa163775886cffb148fae770c3f6e2e7adff980bb14c481950996e0d2097b90bfa7203111f7254cdec65080617128b874b6cd797f41d62f7c568429c

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks