Overview

overview

10

Static

static

8

document-5...13.xls

windows7_x64

10

document-5...13.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document-550193913.xls

  • Size

    91KB

  • Sample

    210408-evv9x8ghre

  • MD5

    4107cd071635b4cc3689f77c688f57c3

  • SHA1

    cf6dea64431b614757906f32d3d1f016b5afdbb5

  • SHA256

    d49b40d468269f57fb87ea6ad7fd8bb303fbeb033dbd45fb4967c34c5dfbc2ed

  • SHA512

    ae568d93ef0c9cea430e18bdf5a27cb5e71fe2e13cfca9c508f196aead42d7a1e68dd863587a0549391b7c08af85de9e6db574c9d819422482ed6529df52c0fb

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://helendunnosteopathy.co.uk/ds/2202.gif

Targets

    • Target

      document-550193913.xls

    • Size

      91KB

    • MD5

      4107cd071635b4cc3689f77c688f57c3

    • SHA1

      cf6dea64431b614757906f32d3d1f016b5afdbb5

    • SHA256

      d49b40d468269f57fb87ea6ad7fd8bb303fbeb033dbd45fb4967c34c5dfbc2ed

    • SHA512

      ae568d93ef0c9cea430e18bdf5a27cb5e71fe2e13cfca9c508f196aead42d7a1e68dd863587a0549391b7c08af85de9e6db574c9d819422482ed6529df52c0fb

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks