Overview

overview

10

Static

static

8

dac938953a...d8.xls

windows7-x64

10

dac938953a...d8.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dac938953a16e9e0c9dbf5a606036d290b8af6196e4d4dae404979e22039ebd8

  • Size

    112KB

  • Sample

    221124-legqpsgh21

  • MD5

    0336cc436c787765c00b01821481c57d

  • SHA1

    e8aa9104a0e783b1c07bf3aa16403d30bf70b1eb

  • SHA256

    dac938953a16e9e0c9dbf5a606036d290b8af6196e4d4dae404979e22039ebd8

  • SHA512

    7e7bc4d9953d84cca74c23105442b1cfc0130cebcb333198d1b88c5b833b261739bd432fa43c37a08ab139f9752ef5903d865d927aebad0efce35b05bb99ed5b

  • SSDEEP

    1536:kYYYUMEx+QbmVLZjPWVbrzQ7eqDTkR62lZ4frbWWt2XKs1M2M/MBN/Aq:+8WVbrzQ7eiTk9cjqaV5kDd

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      dac938953a16e9e0c9dbf5a606036d290b8af6196e4d4dae404979e22039ebd8

    • Size

      112KB

    • MD5

      0336cc436c787765c00b01821481c57d

    • SHA1

      e8aa9104a0e783b1c07bf3aa16403d30bf70b1eb

    • SHA256

      dac938953a16e9e0c9dbf5a606036d290b8af6196e4d4dae404979e22039ebd8

    • SHA512

      7e7bc4d9953d84cca74c23105442b1cfc0130cebcb333198d1b88c5b833b261739bd432fa43c37a08ab139f9752ef5903d865d927aebad0efce35b05bb99ed5b

    • SSDEEP

      1536:kYYYUMEx+QbmVLZjPWVbrzQ7eqDTkR62lZ4frbWWt2XKs1M2M/MBN/Aq:+8WVbrzQ7eiTk9cjqaV5kDd

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks