Overview

overview

10

Static

static

8

2c51b60afd...5a.xls

windows7-x64

10

2c51b60afd...5a.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c51b60afd53c78a31d96673a9ff33bf6d4eec17c774e8cf1dde2018b90b425a

  • Size

    22KB

  • Sample

    221127-nva9zahe8s

  • MD5

    013c90d7a07e365e82fd8ed0103efbe9

  • SHA1

    cf103af76d477d41d25b549c3a17569382631171

  • SHA256

    2c51b60afd53c78a31d96673a9ff33bf6d4eec17c774e8cf1dde2018b90b425a

  • SHA512

    37777260556137d7a611a4702cfc91a66a993a58488c17735858fea027a15b0d9c788c38d687b56bfb9446d2d5a143624d6914a78a5d395692aac04e5ca7e00d

  • SSDEEP

    192:gx5Hh439gyLPUVWYqJo+kIy1PfT468H/y/VDCnnQn1bcYDHBjFNjZDa6X:I7WYqJofIypL46QaNGnQn1oYDHBp

Score
10/10
macromacro_on_action

Malware Config

Targets

    • Target

      2c51b60afd53c78a31d96673a9ff33bf6d4eec17c774e8cf1dde2018b90b425a

    • Size

      22KB

    • MD5

      013c90d7a07e365e82fd8ed0103efbe9

    • SHA1

      cf103af76d477d41d25b549c3a17569382631171

    • SHA256

      2c51b60afd53c78a31d96673a9ff33bf6d4eec17c774e8cf1dde2018b90b425a

    • SHA512

      37777260556137d7a611a4702cfc91a66a993a58488c17735858fea027a15b0d9c788c38d687b56bfb9446d2d5a143624d6914a78a5d395692aac04e5ca7e00d

    • SSDEEP

      192:gx5Hh439gyLPUVWYqJo+kIy1PfT468H/y/VDCnnQn1bcYDHBjFNjZDa6X:I7WYqJofIypL46QaNGnQn1oYDHBp

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks