Overview

overview

10

Static

static

8

08b2447843...92.xls

windows7-x64

10

08b2447843...92.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08b2447843c17b0a208a21947b331dffcee0baa9bd0d5d859b76a9cf0c432392

  • Size

    96KB

  • Sample

    221127-dd779sea64

  • MD5

    2cccc0961e103aa986602a279d6242e8

  • SHA1

    7c3d3a1d5d7f84baaf83068fcf6075c0cc675510

  • SHA256

    08b2447843c17b0a208a21947b331dffcee0baa9bd0d5d859b76a9cf0c432392

  • SHA512

    04cad608a49dccdc527bc8ca594f92441c42cf10dd56ab1365836bbe71367d28cd662a05b636bbee0b303138245dfbe01d12eeee19668f990da77cbae0b61414

  • SSDEEP

    3072:Jd1gxv7yZmspH7+cclKisPI4ukoRWGN6WVbrzQ7ITkFIBAww33XjUJtXwm:X1gxv7yZmspH7+cclKisPI4ukoRWGNc+

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      08b2447843c17b0a208a21947b331dffcee0baa9bd0d5d859b76a9cf0c432392

    • Size

      96KB

    • MD5

      2cccc0961e103aa986602a279d6242e8

    • SHA1

      7c3d3a1d5d7f84baaf83068fcf6075c0cc675510

    • SHA256

      08b2447843c17b0a208a21947b331dffcee0baa9bd0d5d859b76a9cf0c432392

    • SHA512

      04cad608a49dccdc527bc8ca594f92441c42cf10dd56ab1365836bbe71367d28cd662a05b636bbee0b303138245dfbe01d12eeee19668f990da77cbae0b61414

    • SSDEEP

      3072:Jd1gxv7yZmspH7+cclKisPI4ukoRWGN6WVbrzQ7ITkFIBAww33XjUJtXwm:X1gxv7yZmspH7+cclKisPI4ukoRWGNc+

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks