Overview

overview

10

Static

static

8

6c3c1e8bba...b2.xls

windows7-x64

10

6c3c1e8bba...b2.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c3c1e8bba5a728259f1d055eb0a0a47c9be2c9ad80016b2797d4d462f197eb2

  • Size

    117KB

  • Sample

    221125-qckf2adc9s

  • MD5

    eb5f0f064d32ad225cc000b5569ad066

  • SHA1

    2cbed9d606cb554d29b8328a30fae79e13bfe0a3

  • SHA256

    6c3c1e8bba5a728259f1d055eb0a0a47c9be2c9ad80016b2797d4d462f197eb2

  • SHA512

    9bf111140c787f48285e4ba7cdc22c79d656160f3e895f11b233efc3956f4a49623a3f5c803ad5cb26a747260d5b0f5b3d4277eaff96bab58522bb91277abbfe

  • SSDEEP

    3072:DPl6Nc7yRzs1H75wkZUgsQ6NqTBun5oSHi9WVbrzQ7ITk9ujhJtXwyEv4:7l6Nc7yRzs1H75wkZUgsQ6NqTBun5oS5

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      6c3c1e8bba5a728259f1d055eb0a0a47c9be2c9ad80016b2797d4d462f197eb2

    • Size

      117KB

    • MD5

      eb5f0f064d32ad225cc000b5569ad066

    • SHA1

      2cbed9d606cb554d29b8328a30fae79e13bfe0a3

    • SHA256

      6c3c1e8bba5a728259f1d055eb0a0a47c9be2c9ad80016b2797d4d462f197eb2

    • SHA512

      9bf111140c787f48285e4ba7cdc22c79d656160f3e895f11b233efc3956f4a49623a3f5c803ad5cb26a747260d5b0f5b3d4277eaff96bab58522bb91277abbfe

    • SSDEEP

      3072:DPl6Nc7yRzs1H75wkZUgsQ6NqTBun5oSHi9WVbrzQ7ITk9ujhJtXwyEv4:7l6Nc7yRzs1H75wkZUgsQ6NqTBun5oS5

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks