Overview

overview

10

Static

static

8

02bf7d1e4c...b7.xls

windows7-x64

10

02bf7d1e4c...b7.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02bf7d1e4c52e9d41e75797dee71710d3facfeb32e2481edc9a367e7c06ac4b7

  • Size

    118KB

  • Sample

    221125-x51gaada2x

  • MD5

    153476d6a5b62e27d0d2e4d971bfe1ca

  • SHA1

    00a16785e74f79198fe6ea71f1e3b748dec6dab4

  • SHA256

    02bf7d1e4c52e9d41e75797dee71710d3facfeb32e2481edc9a367e7c06ac4b7

  • SHA512

    d86d3acefc326b5e0f43f1e2de8035a5343aca9f72d5fb50df72fce1ebe463491f185340131e646d423b5ccc6cc260b6ef08d7f129766a1a25be35ba2e792642

  • SSDEEP

    3072:i+l6Nc7yRzs1H75wkZUgsQ6NqTBun5oTAKWVbrzQ7ITk3Unu/JtXwiyF3:Rl6Nc7yRzs1H75wkZUgsQ6NqTBun5okt

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      02bf7d1e4c52e9d41e75797dee71710d3facfeb32e2481edc9a367e7c06ac4b7

    • Size

      118KB

    • MD5

      153476d6a5b62e27d0d2e4d971bfe1ca

    • SHA1

      00a16785e74f79198fe6ea71f1e3b748dec6dab4

    • SHA256

      02bf7d1e4c52e9d41e75797dee71710d3facfeb32e2481edc9a367e7c06ac4b7

    • SHA512

      d86d3acefc326b5e0f43f1e2de8035a5343aca9f72d5fb50df72fce1ebe463491f185340131e646d423b5ccc6cc260b6ef08d7f129766a1a25be35ba2e792642

    • SSDEEP

      3072:i+l6Nc7yRzs1H75wkZUgsQ6NqTBun5oTAKWVbrzQ7ITk3Unu/JtXwiyF3:Rl6Nc7yRzs1H75wkZUgsQ6NqTBun5okt

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks