Overview

overview

10

Static

static

8

Payment.CA4GY0.xlsb

windows7_x64

10

Payment.CA4GY0.xlsb

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment.CA4GY0.xlsb

  • Size

    255KB

  • Sample

    211013-sykd9seec2

  • MD5

    f233c90b2a5964be246baa4c5daded3f

  • SHA1

    d1619666d51b483ac2736e2483ed35016ab98ad8

  • SHA256

    885b0aad6a8cdc2d7c9f02d1f76374d8c345eb32a2ce04ecef7fbf65abb75791

  • SHA512

    96cb099703e190755e523b32cf99929f39f79fc3bdae8409cfe7eda8db3c3abe29fbd1e32941117a3901b86ee3ebc133d5eb432ce0fdb9ba6abb56386414d829

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      Payment.CA4GY0.xlsb

    • Size

      255KB

    • MD5

      f233c90b2a5964be246baa4c5daded3f

    • SHA1

      d1619666d51b483ac2736e2483ed35016ab98ad8

    • SHA256

      885b0aad6a8cdc2d7c9f02d1f76374d8c345eb32a2ce04ecef7fbf65abb75791

    • SHA512

      96cb099703e190755e523b32cf99929f39f79fc3bdae8409cfe7eda8db3c3abe29fbd1e32941117a3901b86ee3ebc133d5eb432ce0fdb9ba6abb56386414d829

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks