Overview

overview

10

Static

static

8

3a23b954e2...d3.xls

windows7-x64

10

3a23b954e2...d3.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a23b954e2f6c61916e9b733fa17d94893452dcf07668f2cf3a8b697082a46d3

  • Size

    111KB

  • Sample

    221128-c41enshc69

  • MD5

    8399f63198333d9cc3b5237132ce4e49

  • SHA1

    97dc167eae08060b7ea8136c767de8c8c57c8035

  • SHA256

    3a23b954e2f6c61916e9b733fa17d94893452dcf07668f2cf3a8b697082a46d3

  • SHA512

    2275371dffb0d5e149a3d1fdf08a619731ef8183117816ad7d07f65171b22583ab323babca389d91903b22b9d294cb88583df5e01215ff445205512a3a4afa4f

  • SSDEEP

    1536:2tttBpRFBDEgBtieWnYHfZ2DnUt03g3IZ95BMqzmptHhWVbrzQ72zzTkiD2lkmYQ:KsMymp/WVbrzQ72/TkDamYRn/Kv4Ml

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      3a23b954e2f6c61916e9b733fa17d94893452dcf07668f2cf3a8b697082a46d3

    • Size

      111KB

    • MD5

      8399f63198333d9cc3b5237132ce4e49

    • SHA1

      97dc167eae08060b7ea8136c767de8c8c57c8035

    • SHA256

      3a23b954e2f6c61916e9b733fa17d94893452dcf07668f2cf3a8b697082a46d3

    • SHA512

      2275371dffb0d5e149a3d1fdf08a619731ef8183117816ad7d07f65171b22583ab323babca389d91903b22b9d294cb88583df5e01215ff445205512a3a4afa4f

    • SSDEEP

      1536:2tttBpRFBDEgBtieWnYHfZ2DnUt03g3IZ95BMqzmptHhWVbrzQ72zzTkiD2lkmYQ:KsMymp/WVbrzQ72/TkDamYRn/Kv4Ml

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks