Overview

overview

10

Static

static

8

43d4bb7a54...4c.xls

windows7-x64

10

43d4bb7a54...4c.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43d4bb7a5498ca535c4ae3daedf83858812b87bae3ad8e63fd616170f53fda4c

  • Size

    133KB

  • Sample

    221126-dnrchage84

  • MD5

    5dc23c1bb522f648a3378927810144f9

  • SHA1

    63bc0c9254d171c58112b1ddc68ada977adc4492

  • SHA256

    43d4bb7a5498ca535c4ae3daedf83858812b87bae3ad8e63fd616170f53fda4c

  • SHA512

    5d7e7d733799d3df9bb142ae490d9a2be73eb332293ec7dbbd405b7b5d105a3cd8095e1c290aea83ca5557895339a28b51b4177dd6ea05d811b22ce8812ab42f

  • SSDEEP

    1536:NpbrbuT5D8JJJ2ARaTraw83iU2jcc0lbxOvTgZ80I/cJtXwPvS:uAN2jcc0lbxOrwIEJtXwnS

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      43d4bb7a5498ca535c4ae3daedf83858812b87bae3ad8e63fd616170f53fda4c

    • Size

      133KB

    • MD5

      5dc23c1bb522f648a3378927810144f9

    • SHA1

      63bc0c9254d171c58112b1ddc68ada977adc4492

    • SHA256

      43d4bb7a5498ca535c4ae3daedf83858812b87bae3ad8e63fd616170f53fda4c

    • SHA512

      5d7e7d733799d3df9bb142ae490d9a2be73eb332293ec7dbbd405b7b5d105a3cd8095e1c290aea83ca5557895339a28b51b4177dd6ea05d811b22ce8812ab42f

    • SSDEEP

      1536:NpbrbuT5D8JJJ2ARaTraw83iU2jcc0lbxOvTgZ80I/cJtXwPvS:uAN2jcc0lbxOrwIEJtXwnS

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks