Overview

overview

10

Static

static

8

Invoice-25...3.xlsb

windows7_x64

10

Invoice-25...3.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice-256533_20211013.xlsb

  • Size

    213KB

  • Sample

    211018-s6g9waeggp

  • MD5

    a3ecb3506d1b62677d0015c0c64868bf

  • SHA1

    6a9880a8f5b40e49ba7a966c4576282aa3c573b1

  • SHA256

    02444552f91d18689921788e3f127f03e857fb189d962a55348cd649109f3401

  • SHA512

    c1b8ae38c3157e0b29109c27ae9b3a27b16f6ba9c87b1c792fadb6107cb1cf0ee2624555482af9d210c2197b69c8341c3b1f042a5020598a1c058d9432d22d5f

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      Invoice-256533_20211013.xlsb

    • Size

      213KB

    • MD5

      a3ecb3506d1b62677d0015c0c64868bf

    • SHA1

      6a9880a8f5b40e49ba7a966c4576282aa3c573b1

    • SHA256

      02444552f91d18689921788e3f127f03e857fb189d962a55348cd649109f3401

    • SHA512

      c1b8ae38c3157e0b29109c27ae9b3a27b16f6ba9c87b1c792fadb6107cb1cf0ee2624555482af9d210c2197b69c8341c3b1f042a5020598a1c058d9432d22d5f

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks