Overview

overview

10

Static

static

8

秦皇岛�...��.xls

windows7-x64

10

秦皇岛�...��.xls

windows10-2004-x64

10

秦皇岛�...��.xls

windows7-x64

10

秦皇岛�...��.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca088f7b8f3babefc521fd4f9cd5c423448ac48390e91495211a12dbbe8f9908

  • Size

    121KB

  • Sample

    221126-dn5j5abh3w

  • MD5

    9d4b5ad5b077f308cb15eb8f2cf4593b

  • SHA1

    c8ab1af04e9b48b1546da1d493e117723dc5ae2c

  • SHA256

    ca088f7b8f3babefc521fd4f9cd5c423448ac48390e91495211a12dbbe8f9908

  • SHA512

    9bba5839c93a5e86f6ac48df2c2c4d8f6b753a0bd02ce7c6e37b83225d7dfe707d5cc2b251f5efaabee829e178a4c7cb47deaa909a237ede4e55283fc1937578

  • SSDEEP

    3072:Hvg1H+5QuqaKTz/8NfjrNBoStjL7ojLs3pivDR:HvatujbjbZvE3vDR

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      秦皇岛校区2011-2012-2学期补考安排/秦皇岛校区2011-2012-2学期不及格专业课程补考安排.xls

    • Size

      282KB

    • MD5

      46ceb6b45d64ecf1dc564a6477d92067

    • SHA1

      5b27a3d6bf7e4f58da41fcd5a83a514cee6e6e0c

    • SHA256

      664e2334cbfa8c113e4d6554823b5c5da936e3d695d1ac46c0026e836bfc75de

    • SHA512

      b9853ec591cc366e4e27441f96d52b9b6ebd8b9f7846062c1b51e9f2e4de7bb620408e6a99923112e05d5e3f66695e45af6962d8e3057eb0d9222db54b8ffdeb

    • SSDEEP

      3072:lfG+k5N8VZ8GDNsGb0QEIxpUAaKI8TKKC3quWeSrbM0hubjWvZc8ANsOCWVbrzgP:1Zxr/H2jWRxv+

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

    • Target

      秦皇岛校区2011-2012-2学期补考安排/秦皇岛校区2011-2012-2学期不及格公共课程补考安排.xls

    • Size

      327KB

    • MD5

      954f3e7049f47fef2f73eaf529e67ae7

    • SHA1

      f3ff579b4199961db4b6b60480c5fd6d9ae8f4fa

    • SHA256

      c4eabb13a666ce38078cc777e46d5b9242e058ac76194ab6237486141c677f20

    • SHA512

      328dd00fff7300d39a2f48b879e3eb6e2833bea530162d61290a7e9aa69f364546d1976ff38809ee8c4c86a81e29c1fc4317165e039cd4afd4eb0a23dec03014

    • SSDEEP

      3072:7NOHfhgoYlbuqRmvFwiLuidawDSrAKEViDOCb+fP5tLCFvdj9Hdb3NAzhxs6U7n/:QfsMT07HH

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks