Overview

overview

10

Static

static

8

d9f077cc38...ca.xls

windows7-x64

10

d9f077cc38...ca.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9f077cc38971ac8e71365f169088dae6dc80607218de597143898b239f60bca

  • Size

    109KB

  • Sample

    221121-pdbpvahf98

  • MD5

    03f4c4372a116cb2879ab06f3a2f7d70

  • SHA1

    986f213500b777eab01ccd64cfde9e8941d6a3c6

  • SHA256

    d9f077cc38971ac8e71365f169088dae6dc80607218de597143898b239f60bca

  • SHA512

    00df5be0cbb1edb1eb38b23e614295552a4a42e1c5117dfb219507fe943c234cba6aadac8ab6b7a9ae951c37b9545c993423a3bce302f2a37656b41f672b3749

  • SSDEEP

    1536:gQQQQe9fD7KqF1ae5ZQKib096ZcETgZ9591eKcIVGsMVsWViBWcJrzQ7ITkR62lC:6c8KcM9WV1yrzQ7ITk9kjqae5kfN

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      d9f077cc38971ac8e71365f169088dae6dc80607218de597143898b239f60bca

    • Size

      109KB

    • MD5

      03f4c4372a116cb2879ab06f3a2f7d70

    • SHA1

      986f213500b777eab01ccd64cfde9e8941d6a3c6

    • SHA256

      d9f077cc38971ac8e71365f169088dae6dc80607218de597143898b239f60bca

    • SHA512

      00df5be0cbb1edb1eb38b23e614295552a4a42e1c5117dfb219507fe943c234cba6aadac8ab6b7a9ae951c37b9545c993423a3bce302f2a37656b41f672b3749

    • SSDEEP

      1536:gQQQQe9fD7KqF1ae5ZQKib096ZcETgZ9591eKcIVGsMVsWViBWcJrzQ7ITkR62lC:6c8KcM9WV1yrzQ7ITk9kjqae5kfN

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks