Overview

overview

10

Static

static

8

c1d6cd94ab...39.xls

windows7-x64

10

c1d6cd94ab...39.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1d6cd94abead900db8b1eaa1a4a8795e24a9bc6c8ce3d376bbffd1fae148b39

  • Size

    96KB

  • Sample

    221203-pxlddsbc85

  • MD5

    74935ce82b9df2abfd2a06a089727f00

  • SHA1

    b0bb8bab4fe8af3f24f15b4b7852a868f851ed53

  • SHA256

    c1d6cd94abead900db8b1eaa1a4a8795e24a9bc6c8ce3d376bbffd1fae148b39

  • SHA512

    f0612e65520ae7b70876593e1efe0fa8a97b554e6bd68c6363ff008b16a7dd29b170064f0960c46f56afba623372999f6d067134c33f7a428530da79353d8663

  • SSDEEP

    1536:yRRRdY7OleUw+i++UNJxbyQyS2jcc0lbxOqTgZvC88ScJtXwCUeW:oleU6++UNJ32jcc0lbxOKrjhJtXwdeW

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      c1d6cd94abead900db8b1eaa1a4a8795e24a9bc6c8ce3d376bbffd1fae148b39

    • Size

      96KB

    • MD5

      74935ce82b9df2abfd2a06a089727f00

    • SHA1

      b0bb8bab4fe8af3f24f15b4b7852a868f851ed53

    • SHA256

      c1d6cd94abead900db8b1eaa1a4a8795e24a9bc6c8ce3d376bbffd1fae148b39

    • SHA512

      f0612e65520ae7b70876593e1efe0fa8a97b554e6bd68c6363ff008b16a7dd29b170064f0960c46f56afba623372999f6d067134c33f7a428530da79353d8663

    • SSDEEP

      1536:yRRRdY7OleUw+i++UNJxbyQyS2jcc0lbxOqTgZvC88ScJtXwCUeW:oleU6++UNJ32jcc0lbxOKrjhJtXwdeW

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks