Overview

overview

10

Static

static

8

inform_1373.xlsb

windows7_x64

10

inform_1373.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    inform_1373.xlsb

  • Size

    74KB

  • Sample

    210315-tnt6f5y66n

  • MD5

    4ce66b772dc6f8c4de59f8ebf6cae765

  • SHA1

    a5deb92e214d8c21b159d9a9682ade54a0172766

  • SHA256

    f9e9300992a934b5c46671bfd308552b4c565427eb7c9f744be2f8631d038597

  • SHA512

    4063e260d0c198cee636fb04627cc3045e7c5de5b8f1674c7fbbeaefb028c28bf7e1c55076d300979f7fd994b62495d7c97b7e62e4975c0e1455f882f2cd20cc

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://onlinestatis.casa/signup.jpg

Targets

    • Target

      inform_1373.xlsb

    • Size

      74KB

    • MD5

      4ce66b772dc6f8c4de59f8ebf6cae765

    • SHA1

      a5deb92e214d8c21b159d9a9682ade54a0172766

    • SHA256

      f9e9300992a934b5c46671bfd308552b4c565427eb7c9f744be2f8631d038597

    • SHA512

      4063e260d0c198cee636fb04627cc3045e7c5de5b8f1674c7fbbeaefb028c28bf7e1c55076d300979f7fd994b62495d7c97b7e62e4975c0e1455f882f2cd20cc

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks