Overview

overview

10

Static

static

8

SecuriteIn...9.xlsm

windows7_x64

10

SecuriteIn...9.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Trojan.Win32.Macro40.11000280.5135.4519

  • Size

    149KB

  • Sample

    210315-fbzhkt3d3s

  • MD5

    1279c603a4e9536e23c3de5986105b62

  • SHA1

    0d116a02ce3c69aaade6e158983cd179943f35ef

  • SHA256

    7b88ed5cba5dd03d9541a72b0a94c14ad73621c164ddade4c9b065de03a4df48

  • SHA512

    77094082b3fa6233f558fa37034d4622be9231e0754e9eb20e4e278250366df0170ce4bdf3659b20b387566df332366fb98ac21752183623fefe2f65425c2034

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.ceder-invest.be/sass/capital.php

Targets

    • Target

      SecuriteInfo.com.Trojan.Win32.Macro40.11000280.5135.4519

    • Size

      149KB

    • MD5

      1279c603a4e9536e23c3de5986105b62

    • SHA1

      0d116a02ce3c69aaade6e158983cd179943f35ef

    • SHA256

      7b88ed5cba5dd03d9541a72b0a94c14ad73621c164ddade4c9b065de03a4df48

    • SHA512

      77094082b3fa6233f558fa37034d4622be9231e0754e9eb20e4e278250366df0170ce4bdf3659b20b387566df332366fb98ac21752183623fefe2f65425c2034

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks