Overview

overview

10

Static

static

8

IVSG-5.xlsm

windows7_x64

10

IVSG-5.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IVSG-5.xlsm

  • Size

    83KB

  • Sample

    220112-m7nv6acdhj

  • MD5

    87c6c7d48700f1d10564840e9db0ee5a

  • SHA1

    dc4ab236d49a710ba727cc5e8e0fca7511a028e3

  • SHA256

    c4d0f3ae42ee96525f7c0b08e3e7eab28f6560c351b324b2926d0e74cd8c004c

  • SHA512

    c41c1282a2c1d2c7a44ec1f625a3d3ca18fa4e7fbb52261df589d78e5a3c8da35f6a2715175d56fbf368d58569a8f55695a9777ea53ca5c75ce8173f00e2dc3d

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/

Targets

    • Target

      IVSG-5.xlsm

    • Size

      83KB

    • MD5

      87c6c7d48700f1d10564840e9db0ee5a

    • SHA1

      dc4ab236d49a710ba727cc5e8e0fca7511a028e3

    • SHA256

      c4d0f3ae42ee96525f7c0b08e3e7eab28f6560c351b324b2926d0e74cd8c004c

    • SHA512

      c41c1282a2c1d2c7a44ec1f625a3d3ca18fa4e7fbb52261df589d78e5a3c8da35f6a2715175d56fbf368d58569a8f55695a9777ea53ca5c75ce8173f00e2dc3d

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks