Overview

overview

10

Static

static

8

Macro test.doc

windows7_x64

10

Macro test.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c99223b4bbaace53b0ab0d0b44621fa1
  • Size 7KB
  • Sample211012-rhwlxscea9
  • SHA256 4ac93a85be004f0feb9429b5fdda53db870a81d5ca7fee0e6b0b42254028802c
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionxlm

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://orange.com

Targets

    • Target
      Macro test.doc
    • Size 29KB
    • SHA256 469b70d30f5762bced3abbf5aa221b64f9d298b70015d26476cad8c404ec96b5
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks