Overview

overview

10

Static

static

8

d6392b1904...1e.xls

windows7-x64

10

d6392b1904...1e.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6392b1904c96acaf30b5d03dc12fab67a47e373bb1c4daf604e05cc668d411e

  • Size

    252KB

  • Sample

    221123-1kr6ysaf3t

  • MD5

    0aa5bdf430dfe3128a02cb11e4cfe86f

  • SHA1

    a348c380dc7362694bdc713baf3af41a9122a92e

  • SHA256

    d6392b1904c96acaf30b5d03dc12fab67a47e373bb1c4daf604e05cc668d411e

  • SHA512

    de425b4b574c6c9ba264f44c471720f3dc1c63cba2e329875b16e31185cc07a2a44d1c8bc9dbedc06eba5fc18389231bdd2c4db9a08c6327336dd4534fe72acb

  • SSDEEP

    3072:4zKj/FwBN4gI1XVFJGLBrWVbrz4yR37ITkZEFfX1qiSAk:RzRGNtyRs1g

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      d6392b1904c96acaf30b5d03dc12fab67a47e373bb1c4daf604e05cc668d411e

    • Size

      252KB

    • MD5

      0aa5bdf430dfe3128a02cb11e4cfe86f

    • SHA1

      a348c380dc7362694bdc713baf3af41a9122a92e

    • SHA256

      d6392b1904c96acaf30b5d03dc12fab67a47e373bb1c4daf604e05cc668d411e

    • SHA512

      de425b4b574c6c9ba264f44c471720f3dc1c63cba2e329875b16e31185cc07a2a44d1c8bc9dbedc06eba5fc18389231bdd2c4db9a08c6327336dd4534fe72acb

    • SSDEEP

      3072:4zKj/FwBN4gI1XVFJGLBrWVbrz4yR37ITkZEFfX1qiSAk:RzRGNtyRs1g

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks