Overview

overview

10

Static

static

8

d5fd9f154b...c5.xls

windows7-x64

10

d5fd9f154b...c5.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5

  • Size

    58KB

  • Sample

    221129-km65wsdb29

  • MD5

    6d2d680fa88341b1920538aa105fab88

  • SHA1

    ea2176911810bcb47ae7df41750117246cb2ff52

  • SHA256

    d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5

  • SHA512

    a5a472eb3392aae20162aa6585437587055b61a1f8e4038140d7fa362b96f173556221ea1bf633c2d7e0d6706f4fa5ded9f82ac3401049c6ea80492858f90868

  • SSDEEP

    768:MrrrfC+2XR2HqUMLFz0kTKiMY3og/1JFNhSenFZctwFiJtF26mDF5dIXF7rF/0qK:MrrrfC+2wp2+3IRaD7NTe

Score
10/10
evasionmacropersistencexlm

Malware Config

Targets

    • Target

      d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5

    • Size

      58KB

    • MD5

      6d2d680fa88341b1920538aa105fab88

    • SHA1

      ea2176911810bcb47ae7df41750117246cb2ff52

    • SHA256

      d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5

    • SHA512

      a5a472eb3392aae20162aa6585437587055b61a1f8e4038140d7fa362b96f173556221ea1bf633c2d7e0d6706f4fa5ded9f82ac3401049c6ea80492858f90868

    • SSDEEP

      768:MrrrfC+2XR2HqUMLFz0kTKiMY3og/1JFNhSenFZctwFiJtF26mDF5dIXF7rF/0qK:MrrrfC+2wp2+3IRaD7NTe

    Score
    10/10
    evasionpersistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks