Overview

overview

10

Static

static

8

b22c83bd91...b5.xls

windows7-x64

10

b22c83bd91...b5.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b22c83bd912a9dc0a5bc70693f27083f01f83b0c1d4a0440cb4a9abf89ceedb5

  • Size

    306KB

  • Sample

    221201-mm74asdf8w

  • MD5

    f4e3a59e579871949a501e68aefc5262

  • SHA1

    c828e7eae0c3b0089b51d7e1a9ed59a065283221

  • SHA256

    b22c83bd912a9dc0a5bc70693f27083f01f83b0c1d4a0440cb4a9abf89ceedb5

  • SHA512

    aa02c5480e82e22aa76c1bbde933fa7f4e540a8c0927ca3f3d37791697fe6eec573c91428d02eb1ff807a84d861fce208846904a8bf76b7a5e6777387925e9d2

  • SSDEEP

    6144:TrXo2Ps/uM2Jvd4Qw5c6NOagicAZkvKxjkHClX5c39eucxBoKG:Q2Ps/UdY5kycWNuCNSUXnG

Score
10/10
evasionmacromacro_on_actionpersistencexlm

Malware Config

Targets

    • Target

      b22c83bd912a9dc0a5bc70693f27083f01f83b0c1d4a0440cb4a9abf89ceedb5

    • Size

      306KB

    • MD5

      f4e3a59e579871949a501e68aefc5262

    • SHA1

      c828e7eae0c3b0089b51d7e1a9ed59a065283221

    • SHA256

      b22c83bd912a9dc0a5bc70693f27083f01f83b0c1d4a0440cb4a9abf89ceedb5

    • SHA512

      aa02c5480e82e22aa76c1bbde933fa7f4e540a8c0927ca3f3d37791697fe6eec573c91428d02eb1ff807a84d861fce208846904a8bf76b7a5e6777387925e9d2

    • SSDEEP

      6144:TrXo2Ps/uM2Jvd4Qw5c6NOagicAZkvKxjkHClX5c39eucxBoKG:Q2Ps/UdY5kycWNuCNSUXnG

    Score
    10/10
    evasionmacromacro_on_actionpersistencexlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Office macro that triggers on suspicious action

      Office document macro which triggers in special circumstances - often malicious.

      macromacro_on_action

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks