Overview

overview

10

Static

static

3432.xlsx

windows7_x64

10

3432.xlsx

windows10-2004_x64

10

decrypted.xlsx

windows7_x64

10

decrypted.xlsx

windows10-2004_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3432.xlsx

  • Size

    133KB

  • Sample

    220712-ryapdsebfj

  • MD5

    53ca1cb055fc378db64fb5da2be2dffe

  • SHA1

    660385a656c78e079c9c5969c6cb8a490d2271df

  • SHA256

    dccbc6302f527a55848059cfbd9345e9697dfd9ce1a010b620c12a56db76e062

  • SHA512

    66442c4f67edc443143298418ac87a635dfd1a5613e2cc48fc3a5d449b2124a1ed9a5d4d75df723fe5ae239f2d49f3a517612268ab864a8eefd9995902a03a86

Score
10/10
googlepersistencephishing

Malware Config

Targets

    • Target

      3432.xlsx

    • Size

      133KB

    • MD5

      53ca1cb055fc378db64fb5da2be2dffe

    • SHA1

      660385a656c78e079c9c5969c6cb8a490d2271df

    • SHA256

      dccbc6302f527a55848059cfbd9345e9697dfd9ce1a010b620c12a56db76e062

    • SHA512

      66442c4f67edc443143298418ac87a635dfd1a5613e2cc48fc3a5d449b2124a1ed9a5d4d75df723fe5ae239f2d49f3a517612268ab864a8eefd9995902a03a86

    Score
    10/10
    googlephishingpersistence

    • Detected google phishing page

      phishinggoogle

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

    • Target

      decrypted

    • Size

      125KB

    • MD5

      32de988dac33588f013a37a83521a265

    • SHA1

      13f646dff9f54c52a535b03bf0a1ba803f9eadf8

    • SHA256

      54e48efba5879846c7fece3d715d474532dc23fbe321b7d72d1c473c04a4fee8

    • SHA512

      c9a718b9560336359fb483952d55c04ad583b257761994228e811912de7d1fa499c51794ed532a501004975545444204c4137800d04441a3843d8b5c8b7066fa

    Score
    10/10
    googlephishing

    • Detected google phishing page

      phishinggoogle

    • Legitimate hosting services abused for malware hosting/C2

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

2
T1102

Impact

Tasks