Overview

overview

10

Static

static

8

data_state...s.xlsm

windows7_x64

10

data_state...s.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    data_statements_invoices_receipets.xlsm

  • Size

    11KB

  • Sample

    210723-dmy3e6v7pa

  • MD5

    c46864b60cbd593540b0df1b98a6f720

  • SHA1

    1d61db1e0274d4c8bc9a259526d4f0af93a5d7e5

  • SHA256

    1e6a26062bbb9fb04dfd48aada29254b8c4e4c4d657b977f4f496e3e2c26ab84

  • SHA512

    3913df61e054b29d3bb1db6d35ba023f981fe59108ae60ac9181fc8ba2cb992c12ae26cbf7a2acf3650b29eab665599ffcdbcf4f7668b9bf5af047c419244172

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      data_statements_invoices_receipets.xlsm

    • Size

      11KB

    • MD5

      c46864b60cbd593540b0df1b98a6f720

    • SHA1

      1d61db1e0274d4c8bc9a259526d4f0af93a5d7e5

    • SHA256

      1e6a26062bbb9fb04dfd48aada29254b8c4e4c4d657b977f4f496e3e2c26ab84

    • SHA512

      3913df61e054b29d3bb1db6d35ba023f981fe59108ae60ac9181fc8ba2cb992c12ae26cbf7a2acf3650b29eab665599ffcdbcf4f7668b9bf5af047c419244172

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks