Overview

overview

10

Static

static

8

6278e98093...4f.xls

windows7-x64

10

6278e98093...4f.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6278e9809353e83e2d9f35aabf00862ae4f13e9a6c73e11874cd12e78b23274f

  • Size

    110KB

  • Sample

    221129-knnd6sdb68

  • MD5

    1349495a04d9fe9b8dfce8fd2f924bfc

  • SHA1

    dae0b6a868b84e2f4aeeb53e806af16238fc93c4

  • SHA256

    6278e9809353e83e2d9f35aabf00862ae4f13e9a6c73e11874cd12e78b23274f

  • SHA512

    2284a27e9eff295c326b7f6cc9d9812447591986a21190ef655f6ec44af1d9009de38cb4df9f1745fa4d6096a935ae9647cb1b3534260b11f5f9629d4735ad83

  • SSDEEP

    1536:qCCCoMnZj/XGmR2Cd9EG+3g/dZ95uZZBez5WVbrek6KYQ7ITkiD2wxDp/WwF1p73:3OZoWVbreXpQ7ITkDwldkl5k5n

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      6278e9809353e83e2d9f35aabf00862ae4f13e9a6c73e11874cd12e78b23274f

    • Size

      110KB

    • MD5

      1349495a04d9fe9b8dfce8fd2f924bfc

    • SHA1

      dae0b6a868b84e2f4aeeb53e806af16238fc93c4

    • SHA256

      6278e9809353e83e2d9f35aabf00862ae4f13e9a6c73e11874cd12e78b23274f

    • SHA512

      2284a27e9eff295c326b7f6cc9d9812447591986a21190ef655f6ec44af1d9009de38cb4df9f1745fa4d6096a935ae9647cb1b3534260b11f5f9629d4735ad83

    • SSDEEP

      1536:qCCCoMnZj/XGmR2Cd9EG+3g/dZ95uZZBez5WVbrek6KYQ7ITkiD2wxDp/WwF1p73:3OZoWVbreXpQ7ITkDwldkl5k5n

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks