Overview

overview

10

Static

static

8

30368a219f...bc.xls

windows7-x64

10

30368a219f...bc.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30368a219f589668cad7d2e968c0453f77179109bcfbe1ba9c4708ac87f9f6bc

  • Size

    126KB

  • Sample

    221126-dn8lsabh4s

  • MD5

    88508ff8de4dd1d04476e73af1da3257

  • SHA1

    e805fece3934b518db82547ade20566ac802cf27

  • SHA256

    30368a219f589668cad7d2e968c0453f77179109bcfbe1ba9c4708ac87f9f6bc

  • SHA512

    0980083099117311bb102550af36a41f6c94fb85d6e6cfa310a2d8fbb016eb391fe1bdfc4cfcaa49117f64aec66522b40658cc4202014fc7ca146ae5860cb87e

  • SSDEEP

    1536:lQQQQ/PuBkapzNC9LFujoBWVOrzQ7ITkzSDA23bcfreWWt2XKu2p:pekapzsWVOrzQ7ITkzcwjva5p

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      30368a219f589668cad7d2e968c0453f77179109bcfbe1ba9c4708ac87f9f6bc

    • Size

      126KB

    • MD5

      88508ff8de4dd1d04476e73af1da3257

    • SHA1

      e805fece3934b518db82547ade20566ac802cf27

    • SHA256

      30368a219f589668cad7d2e968c0453f77179109bcfbe1ba9c4708ac87f9f6bc

    • SHA512

      0980083099117311bb102550af36a41f6c94fb85d6e6cfa310a2d8fbb016eb391fe1bdfc4cfcaa49117f64aec66522b40658cc4202014fc7ca146ae5860cb87e

    • SSDEEP

      1536:lQQQQ/PuBkapzNC9LFujoBWVOrzQ7ITkzSDA23bcfreWWt2XKu2p:pekapzsWVOrzQ7ITkzcwjva5p

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks