Overview

overview

10

Static

static

6e108b6bf0...a7.xls

windows7_x64

10

6e108b6bf0...a7.xls

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e108b6bf01d450ff3e96b075381417229b1591373047992964375790c6c19a7.xls

  • Size

    8KB

  • Sample

    211125-txecasfgck

  • MD5

    8cb3b37892675e7fd0322c77ac9cb272

  • SHA1

    43de631b9b9c6b0a0ab9743ab471e4546ee18300

  • SHA256

    6e108b6bf01d450ff3e96b075381417229b1591373047992964375790c6c19a7

  • SHA512

    ce8504b89a1a92f297e6de6317387c7bb09a409591ab85d4773b93891cb22f21bd6114087febe3dab63bbecec43e3bb29767e4a8ad1ea1db13d10368db060ab6

Score
10/10

Malware Config

Targets

    • Target

      6e108b6bf01d450ff3e96b075381417229b1591373047992964375790c6c19a7.xls

    • Size

      8KB

    • MD5

      8cb3b37892675e7fd0322c77ac9cb272

    • SHA1

      43de631b9b9c6b0a0ab9743ab471e4546ee18300

    • SHA256

      6e108b6bf01d450ff3e96b075381417229b1591373047992964375790c6c19a7

    • SHA512

      ce8504b89a1a92f297e6de6317387c7bb09a409591ab85d4773b93891cb22f21bd6114087febe3dab63bbecec43e3bb29767e4a8ad1ea1db13d10368db060ab6

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks