Overview

overview

10

Static

static

8

document-8...86.xls

windows7_x64

10

document-8...86.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    this_issue (44).zip

  • Size

    34KB

  • Sample

    210316-1wmjspxzax

  • MD5

    a716a6e42d16757c577125c56531407b

  • SHA1

    8b237341a765e2cdf4373b594b6d8fe86024d679

  • SHA256

    9b0f0759421dd88b3d1eacf74294e80356db98e7a28b1ae4e75bc1231d01b453

  • SHA512

    4a8e746e2766dd1bef2e6ff995c22cc2e03187e08c88aabf882f1a7a00e05896c3779c0f78bd4d2d206feb2c20da08e89f21c62705f0ede98c4a6d93b45a2114

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://lbgyn15pchoit03azhs.xyz/w.gif

Targets

    • Target

      document-885003386.xls

    • Size

      139KB

    • MD5

      dca3c0ef2322eb5101141318fabfce9e

    • SHA1

      af022d7709ccc998893935535f5601d6949d127a

    • SHA256

      ab16588b094c53d207845b4878ff41f3b1578201cfa2272658f97b33551e028e

    • SHA512

      f2d365e51cfbcccd61a284a02892c8b7d0acb1686470e2def8fcad4a4dc491043ada55cda641910b05e08fec97410029541f233736d675a9612a4dadc5a2ffe3

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks