Overview

overview

10

Static

static

8

fb3351810c...8e.xls

windows7-x64

10

fb3351810c...8e.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb3351810c7b2f776cf8c7bc9a98836cc7fe89c6a1197e5c24bdad21b7eeb08e

  • Size

    214KB

  • Sample

    221126-ysrjaaba49

  • MD5

    0dfe9e30eee8d65f46754dfaf9b0ab03

  • SHA1

    9a549d0d446f03f2e2bc2de8484efbf61d49089b

  • SHA256

    fb3351810c7b2f776cf8c7bc9a98836cc7fe89c6a1197e5c24bdad21b7eeb08e

  • SHA512

    b4476133a07531ef0c24b44b7c97284b0b6dc35b0e74106b098f29b20628a1666e00afdbf10713a3e843375405f90832673ca9ed90c8c0fdd47980f30695f70c

  • SSDEEP

    3072:rQUJBhwk97bur8yhwc9CpWVbrzQ7ITkIW1uDamLUV:EUCIU3V6

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      fb3351810c7b2f776cf8c7bc9a98836cc7fe89c6a1197e5c24bdad21b7eeb08e

    • Size

      214KB

    • MD5

      0dfe9e30eee8d65f46754dfaf9b0ab03

    • SHA1

      9a549d0d446f03f2e2bc2de8484efbf61d49089b

    • SHA256

      fb3351810c7b2f776cf8c7bc9a98836cc7fe89c6a1197e5c24bdad21b7eeb08e

    • SHA512

      b4476133a07531ef0c24b44b7c97284b0b6dc35b0e74106b098f29b20628a1666e00afdbf10713a3e843375405f90832673ca9ed90c8c0fdd47980f30695f70c

    • SSDEEP

      3072:rQUJBhwk97bur8yhwc9CpWVbrzQ7ITkIW1uDamLUV:EUCIU3V6

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks