Overview

overview

10

Static

static

8

ffc9eca5a1...0.xlsm

windows7-x64

10

ffc9eca5a1...0.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffc9eca5a1e84b5ebe2d3f7124efbd48d96d24686b429f09743359370f915760

  • Size

    19KB

  • Sample

    221130-s434kada54

  • MD5

    e1add0c2917aaf34236db315da09d8f2

  • SHA1

    3460271d345cc4ba4ab112c5abe04e40e483145e

  • SHA256

    ffc9eca5a1e84b5ebe2d3f7124efbd48d96d24686b429f09743359370f915760

  • SHA512

    e041cf1b0c4aeb491488b027d08ea5c2febd640ce08166f5610e9baf783b2eacf39bd23591c3325255e67d548acca49ba72aeff9f0afcaa0505331f8ce252ecc

  • SSDEEP

    384:+2QdQ5yunO0qEF6C4zfusWGCVXToqIJPXaxq5:+U5D6EFTcKdKMc

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://panelonetwothree.ga/work/6.exe

Targets

    • Target

      ffc9eca5a1e84b5ebe2d3f7124efbd48d96d24686b429f09743359370f915760

    • Size

      19KB

    • MD5

      e1add0c2917aaf34236db315da09d8f2

    • SHA1

      3460271d345cc4ba4ab112c5abe04e40e483145e

    • SHA256

      ffc9eca5a1e84b5ebe2d3f7124efbd48d96d24686b429f09743359370f915760

    • SHA512

      e041cf1b0c4aeb491488b027d08ea5c2febd640ce08166f5610e9baf783b2eacf39bd23591c3325255e67d548acca49ba72aeff9f0afcaa0505331f8ce252ecc

    • SSDEEP

      384:+2QdQ5yunO0qEF6C4zfusWGCVXToqIJPXaxq5:+U5D6EFTcKdKMc

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks