Overview

overview

10

Static

static

8

e6a7b74210...d0.xls

windows7-x64

10

e6a7b74210...d0.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e6a7b74210342e244a5a0d692e49d205fded4f2d75357785ad971a31767923d0

  • Size

    119KB

  • Sample

    221125-xzrbeshd63

  • MD5

    bc975b54fc42712a23b86c4f9cb072a3

  • SHA1

    d19a838a3569ed2831248c2045b6d6f3b340442b

  • SHA256

    e6a7b74210342e244a5a0d692e49d205fded4f2d75357785ad971a31767923d0

  • SHA512

    4729ac1dac2a3547ed664fc5fa27dc3880f20285fcfae8a6fde6594c6302cabc119a869538bc1db904cc11c80085151af742ed6e0640a6d2241a32009bbffc47

  • SSDEEP

    1536:UG666clXwWXbAI7cvwQq/B5ZJChyRfMZ95e+ejRBSWVbrzNKQsz7ITkR62lD5EeU:lx+NWVbrzcz7ITk9fEdJtXwY5kHGNv5

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      e6a7b74210342e244a5a0d692e49d205fded4f2d75357785ad971a31767923d0

    • Size

      119KB

    • MD5

      bc975b54fc42712a23b86c4f9cb072a3

    • SHA1

      d19a838a3569ed2831248c2045b6d6f3b340442b

    • SHA256

      e6a7b74210342e244a5a0d692e49d205fded4f2d75357785ad971a31767923d0

    • SHA512

      4729ac1dac2a3547ed664fc5fa27dc3880f20285fcfae8a6fde6594c6302cabc119a869538bc1db904cc11c80085151af742ed6e0640a6d2241a32009bbffc47

    • SSDEEP

      1536:UG666clXwWXbAI7cvwQq/B5ZJChyRfMZ95e+ejRBSWVbrzNKQsz7ITkR62lD5EeU:lx+NWVbrzcz7ITk9fEdJtXwY5kHGNv5

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks