General
-
Target
New Order.xlsm
-
Size
82KB
-
Sample
211022-cn2b2abad9
-
MD5
6d1e3dead5c950529bc85a11abc20294
-
SHA1
5dc78a09bc2f2b996bb3f112f5523551d76b3c73
-
SHA256
6b1ec5241eaf561d6c06b5b04c17b553c82b42e3ddf25f8771b67c682e8c40cc
-
SHA512
c2bfb50882fec59b6b91001342e655d8248f44a4b3f3be316ffacdac54cfc48eea5fac9ebd1e7459126d5d594ec10ba94701d72bbeaac1bc5340d706ae1e15d5
Behavioral task
behavioral1
Sample
New Order.xlsm
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
New Order.xlsm
Resource
win7-de-20211014
Behavioral task
behavioral3
Sample
New Order.xlsm
Resource
win11
Behavioral task
behavioral4
Sample
New Order.xlsm
Resource
win10-en-20211014
Behavioral task
behavioral5
Sample
New Order.xlsm
Resource
win10-de-20210920
Malware Config
Targets
-
-
Target
New Order.xlsm
-
Size
82KB
-
MD5
6d1e3dead5c950529bc85a11abc20294
-
SHA1
5dc78a09bc2f2b996bb3f112f5523551d76b3c73
-
SHA256
6b1ec5241eaf561d6c06b5b04c17b553c82b42e3ddf25f8771b67c682e8c40cc
-
SHA512
c2bfb50882fec59b6b91001342e655d8248f44a4b3f3be316ffacdac54cfc48eea5fac9ebd1e7459126d5d594ec10ba94701d72bbeaac1bc5340d706ae1e15d5
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Registers COM server for autorun
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
-
Drops file in System32 directory
-