Overview

overview

10

Static

static

8

97d161c2b7...16.xls

windows7-x64

6

97d161c2b7...16.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97d161c2b7539d40f13d0e719ac219b6ecb645f2c5872d0a2f2a0837ecee4116

  • Size

    318KB

  • Sample

    221126-1cntkaae4z

  • MD5

    8ad880d25f705148baefa205b906b363

  • SHA1

    23cc2ae12ee4499a5b562a28017807bdf5168d0d

  • SHA256

    97d161c2b7539d40f13d0e719ac219b6ecb645f2c5872d0a2f2a0837ecee4116

  • SHA512

    eff42190a51a6c02b778e7b0754e8b142c2265782f1cddb0da3490ca12af0444076aad7136a69cd4766ceb2de5d516feb7e55e110640ca28ecf953cdb41af0fa

  • SSDEEP

    6144:0Nd+FWX9VgJkiOxfwPIBDWZbiNJfnNO1NC:0NjCJ8xfwAB2iNJIC

Score
10/10
macropersistencexlm

Malware Config

Targets

    • Target

      97d161c2b7539d40f13d0e719ac219b6ecb645f2c5872d0a2f2a0837ecee4116

    • Size

      318KB

    • MD5

      8ad880d25f705148baefa205b906b363

    • SHA1

      23cc2ae12ee4499a5b562a28017807bdf5168d0d

    • SHA256

      97d161c2b7539d40f13d0e719ac219b6ecb645f2c5872d0a2f2a0837ecee4116

    • SHA512

      eff42190a51a6c02b778e7b0754e8b142c2265782f1cddb0da3490ca12af0444076aad7136a69cd4766ceb2de5d516feb7e55e110640ca28ecf953cdb41af0fa

    • SSDEEP

      6144:0Nd+FWX9VgJkiOxfwPIBDWZbiNJfnNO1NC:0NjCJ8xfwAB2iNJIC

    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Adds Run key to start application

      persistence

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks