Overview

overview

10

Static

static

8

bdc519de19...c3.xls

windows7-x64

10

bdc519de19...c3.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdc519de193ec9595ac30d2bf4fc79db8124fbcf9f429ec18901efd2841e22c3

  • Size

    123KB

  • Sample

    221129-knlwcaga9z

  • MD5

    8e491d585c571464024687188adaa698

  • SHA1

    d9e455251beb40c2515a1f84f21b2ad55d403e17

  • SHA256

    bdc519de193ec9595ac30d2bf4fc79db8124fbcf9f429ec18901efd2841e22c3

  • SHA512

    be992ad2a2eb163bb256e1b06a7ff4c28b1e7c761473bae320d0e601ddfb8c4609a49e9e031a7c23e03f3a3c1b7d940d2ec3d9889abba8dbc55884d146658b27

  • SSDEEP

    3072:I/Z+RwPONXoRjDhIcp0fDlaGGx+cL26nnTWVbl9zQ7ITk9j2AJtXw7mE/YcC4:EZ+RwPONXoRjDhIcp0fDlavx+W26nnK7

Score
10/10
macro

Malware Config

Targets

    • Target

      bdc519de193ec9595ac30d2bf4fc79db8124fbcf9f429ec18901efd2841e22c3

    • Size

      123KB

    • MD5

      8e491d585c571464024687188adaa698

    • SHA1

      d9e455251beb40c2515a1f84f21b2ad55d403e17

    • SHA256

      bdc519de193ec9595ac30d2bf4fc79db8124fbcf9f429ec18901efd2841e22c3

    • SHA512

      be992ad2a2eb163bb256e1b06a7ff4c28b1e7c761473bae320d0e601ddfb8c4609a49e9e031a7c23e03f3a3c1b7d940d2ec3d9889abba8dbc55884d146658b27

    • SSDEEP

      3072:I/Z+RwPONXoRjDhIcp0fDlaGGx+cL26nnTWVbl9zQ7ITk9j2AJtXw7mE/YcC4:EZ+RwPONXoRjDhIcp0fDlavx+W26nnK7

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks