Overview

overview

10

Static

static

8

b065eaf7ed...e9.xls

windows7-x64

10

b065eaf7ed...e9.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b065eaf7ed46a1f2c24eef8d062aa8c7dfd10fac1de147bd3d695fb9fe2974e9

  • Size

    196KB

  • Sample

    221129-s4af9ace87

  • MD5

    2fc30ae79669e8513073d371e9c41cb6

  • SHA1

    6971ad2e57e50cec8efce36f07218dca5cb498b8

  • SHA256

    b065eaf7ed46a1f2c24eef8d062aa8c7dfd10fac1de147bd3d695fb9fe2974e9

  • SHA512

    c21460ca13655a2c48373e639f63ce473f779c53b1bec69e6b20d1025c50674ab1804317d261b31da8ec5d20929c886fb19d05cad1b1e63599bf85444aedff73

  • SSDEEP

    3072:7FMtWcIAu8BcWfiVBL2i6d958zXUQQnp7wyrTWVbrzQ7O6Tk9uu8JtXwD5kxGf:RMtWcI2WBMMXUQd8iAg

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      b065eaf7ed46a1f2c24eef8d062aa8c7dfd10fac1de147bd3d695fb9fe2974e9

    • Size

      196KB

    • MD5

      2fc30ae79669e8513073d371e9c41cb6

    • SHA1

      6971ad2e57e50cec8efce36f07218dca5cb498b8

    • SHA256

      b065eaf7ed46a1f2c24eef8d062aa8c7dfd10fac1de147bd3d695fb9fe2974e9

    • SHA512

      c21460ca13655a2c48373e639f63ce473f779c53b1bec69e6b20d1025c50674ab1804317d261b31da8ec5d20929c886fb19d05cad1b1e63599bf85444aedff73

    • SSDEEP

      3072:7FMtWcIAu8BcWfiVBL2i6d958zXUQQnp7wyrTWVbrzQ7O6Tk9uu8JtXwD5kxGf:RMtWcI2WBMMXUQd8iAg

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks