Overview

overview

10

Static

static

8

New Order.xlsm

windows7_x64

10

New Order.xlsm

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Order.xlsm

  • Size

    82KB

  • Sample

    211022-cjzbwabad7

  • MD5

    6d1e3dead5c950529bc85a11abc20294

  • SHA1

    5dc78a09bc2f2b996bb3f112f5523551d76b3c73

  • SHA256

    6b1ec5241eaf561d6c06b5b04c17b553c82b42e3ddf25f8771b67c682e8c40cc

  • SHA512

    c2bfb50882fec59b6b91001342e655d8248f44a4b3f3be316ffacdac54cfc48eea5fac9ebd1e7459126d5d594ec10ba94701d72bbeaac1bc5340d706ae1e15d5

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      New Order.xlsm

    • Size

      82KB

    • MD5

      6d1e3dead5c950529bc85a11abc20294

    • SHA1

      5dc78a09bc2f2b996bb3f112f5523551d76b3c73

    • SHA256

      6b1ec5241eaf561d6c06b5b04c17b553c82b42e3ddf25f8771b67c682e8c40cc

    • SHA512

      c2bfb50882fec59b6b91001342e655d8248f44a4b3f3be316ffacdac54cfc48eea5fac9ebd1e7459126d5d594ec10ba94701d72bbeaac1bc5340d706ae1e15d5

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks