Overview

overview

10

Static

static

8

79450131a2...cb.xls

windows7-x64

10

79450131a2...cb.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79450131a22167fa2558f2334e612687b58f66ad77cd45a2d8e8933cea95b1cb

  • Size

    205KB

  • Sample

    221127-msfk8seg4t

  • MD5

    3f0b5883f14e2c61c1f792b9af9775a8

  • SHA1

    b0be8c8bbcccb00553e9bf19ec0e05a538492ab3

  • SHA256

    79450131a22167fa2558f2334e612687b58f66ad77cd45a2d8e8933cea95b1cb

  • SHA512

    6363cfb13bc6aa5d8c749030bb2cf141f19645924ceceeb015b7c97da2c2c2f150733e8384e75dac4e815a9324f42541433a1abd1926deb38d3e9f92efd8d898

  • SSDEEP

    3072:RmmpbXG/0HK/EPwzpnjBEHaD1M/4FvzZ0cDM/9XFg2jcc0lbxOr0NJtXwqccYT:R0/oDKlwF0O

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      79450131a22167fa2558f2334e612687b58f66ad77cd45a2d8e8933cea95b1cb

    • Size

      205KB

    • MD5

      3f0b5883f14e2c61c1f792b9af9775a8

    • SHA1

      b0be8c8bbcccb00553e9bf19ec0e05a538492ab3

    • SHA256

      79450131a22167fa2558f2334e612687b58f66ad77cd45a2d8e8933cea95b1cb

    • SHA512

      6363cfb13bc6aa5d8c749030bb2cf141f19645924ceceeb015b7c97da2c2c2f150733e8384e75dac4e815a9324f42541433a1abd1926deb38d3e9f92efd8d898

    • SSDEEP

      3072:RmmpbXG/0HK/EPwzpnjBEHaD1M/4FvzZ0cDM/9XFg2jcc0lbxOr0NJtXwqccYT:R0/oDKlwF0O

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks