Overview

overview

10

Static

static

8

9173221a93...b.xlsm

windows7_x64

10

9173221a93...b.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9173221a937cf1ef14a7fcb5ee89c87162aaf60b6b901405827f43b1871d693b

  • Size

    85KB

  • Sample

    210721-svzwkpyeej

  • MD5

    774c9db0d6227c94806074555e42db67

  • SHA1

    071a3ce6e2fc5e2088bed0ad8bacb6ba71ab31ce

  • SHA256

    9173221a937cf1ef14a7fcb5ee89c87162aaf60b6b901405827f43b1871d693b

  • SHA512

    7cfb01b260b183476a81121ff63053ecf5b93ac1ac345055aefc3c6e4b8def5545f854ca0d0198cf2124dc6fa87fd09eef3b8478672a1e148e12d2ff0476a15b

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      9173221a937cf1ef14a7fcb5ee89c87162aaf60b6b901405827f43b1871d693b

    • Size

      85KB

    • MD5

      774c9db0d6227c94806074555e42db67

    • SHA1

      071a3ce6e2fc5e2088bed0ad8bacb6ba71ab31ce

    • SHA256

      9173221a937cf1ef14a7fcb5ee89c87162aaf60b6b901405827f43b1871d693b

    • SHA512

      7cfb01b260b183476a81121ff63053ecf5b93ac1ac345055aefc3c6e4b8def5545f854ca0d0198cf2124dc6fa87fd09eef3b8478672a1e148e12d2ff0476a15b

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks