Overview

overview

10

Static

static

8

191188385_...7.xlsm

windows7_x64

10

191188385_...7.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    191188385_03360767.xlsm

  • Size

    83KB

  • Sample

    220112-3bsr8seegl

  • MD5

    e985886873885ec5af8db326bbdc716a

  • SHA1

    e07f7373e695a2ff4d5a373a37a7ef8acfeaa229

  • SHA256

    c2ddab3e04d60aef6cc2b227982e2701eeb4fb51f6a76c1f3047dffe536fccaa

  • SHA512

    ebd95ee67efeec682df439804513a59d7c1cf6bff0eee1bc715a5a0a83cd2beb8810eeabf4c1c089346984874a0f205de6221ee5b62e183c34a67b31d2d0ab2c

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://wateringcanreview.xyz/wp-includes/css/qky11a/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://wateringcanreview.xyz/wp-includes/css/qky11a/
xlm40.dropper

http://cakemixturereview.xyz/wp-includes/U2ayYVCPRhWqERyw4/
xlm40.dropper

http://15.237.135.38/dza9hr/kjt6/

Targets

    • Target

      191188385_03360767.xlsm

    • Size

      83KB

    • MD5

      e985886873885ec5af8db326bbdc716a

    • SHA1

      e07f7373e695a2ff4d5a373a37a7ef8acfeaa229

    • SHA256

      c2ddab3e04d60aef6cc2b227982e2701eeb4fb51f6a76c1f3047dffe536fccaa

    • SHA512

      ebd95ee67efeec682df439804513a59d7c1cf6bff0eee1bc715a5a0a83cd2beb8810eeabf4c1c089346984874a0f205de6221ee5b62e183c34a67b31d2d0ab2c

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks