Overview

overview

10

Static

static

8

Compensati...21.xls

windows7_x64

10

Compensati...21.xls

windows10_x64

10

Resubmissions

28-09-2021 20:53

210928-zpkf8sdbem 10

28-09-2021 15:35

210928-s1h9zscdbp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CompensationClaim-68254946-09282021.zip

  • Size

    90KB

  • Sample

    210928-zpkf8sdbem

  • MD5

    751ba3695041a3dfb2d283da3ede15fb

  • SHA1

    002c1f3a1606c6fd24eccf69956d27287ff4f74a

  • SHA256

    b420642be3fb8799c1700185d9a68a7de077fd798ef9ad024f728b5a031fd94c

  • SHA512

    83b5c3ed629f4a0ef47c25878f58ef9b9c86f3c1d3d366c177948fea8254649d1175f4638e1701ddd60186ba3185ba6dcd4a1f7ec2c5d816ba789f58421b3e1a

Score
10/10
macromacro_on_action

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://101.99.90.160/44467.8712109954.dat
xlm40.dropper

http://188.165.62.4/44467.8712109954.dat
xlm40.dropper

http://84.32.188.42/44467.8712109954.dat

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://101.99.90.160/44467.9548384259.dat
xlm40.dropper

http://188.165.62.4/44467.9548384259.dat
xlm40.dropper

http://84.32.188.42/44467.9548384259.dat

Targets

    • Target

      CompensationClaim-68254946-09282021.xls

    • Size

      137KB

    • MD5

      e0574cf808d9b7150bac6b894baec9f0

    • SHA1

      6603fa83dbb84f3a0d35982a37dbc5250699a64a

    • SHA256

      7fddbdbd20255e29207d6765f7c3d19a235be7e55ca6184a76a74c2175da8bf4

    • SHA512

      9f98689c83358a470dd50f9f74fc80147e025acb2b88b3a4c8d100a07b3c159097e56950eeee7a71c490ff2dea85a7fb92b4f354c7d8f3bedb1fb13854f07bb8

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks