Overview

overview

10

Static

static

8

350763-394...1.xlsm

windows7_x64

10

350763-394...1.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    350763-394867-221021.xlsm

  • Size

    140KB

  • Sample

    210722-fpll8bm1jx

  • MD5

    d4fe00d6e9975dd31e96b9d786503069

  • SHA1

    28b875f8547a4bcb0bdc539d784769e7ab8815e8

  • SHA256

    6f5fdf14d35bfe303b9f1b4f3698df919755cb0f76c841f5a9a852939f9c9962

  • SHA512

    4304bd670022078646a4d91d2ceb252eb21be5f2121bdf4e3dbe2719694ae1a4828b6881e387f2d3585b130cf11c5b2502fbcc8c56e037e7de141c97fce57e33

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      350763-394867-221021.xlsm

    • Size

      140KB

    • MD5

      d4fe00d6e9975dd31e96b9d786503069

    • SHA1

      28b875f8547a4bcb0bdc539d784769e7ab8815e8

    • SHA256

      6f5fdf14d35bfe303b9f1b4f3698df919755cb0f76c841f5a9a852939f9c9962

    • SHA512

      4304bd670022078646a4d91d2ceb252eb21be5f2121bdf4e3dbe2719694ae1a4828b6881e387f2d3585b130cf11c5b2502fbcc8c56e037e7de141c97fce57e33

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks