Overview

overview

10

Static

static

8

887abfad68...e0.xls

windows7-x64

10

887abfad68...e0.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    887abfad68f4ec1cbf2ea7bd25612f2856d8c5c83df453a1352096367e82f4e0

  • Size

    90KB

  • Sample

    221206-rtwq3aac7w

  • MD5

    044b8ce73431c25d028f9ab34e3b94de

  • SHA1

    e8aec500e767c9c4f3e1f5c0c48298ced01c321f

  • SHA256

    887abfad68f4ec1cbf2ea7bd25612f2856d8c5c83df453a1352096367e82f4e0

  • SHA512

    1b64146f7b4f730d94e31080baedee3843b674a70bc7080cb61e0f76e74b9a0bbb1002c5e8552132a8a8b0d86ee66420a3fc321a299eec90157df6e65becb5da

  • SSDEEP

    1536:NeeeeKmk8ci8PpOqpgWVbrzQ7ITkZ8A2YaM88ScJWXwkmpM:ei/WVbrzQ7ITkkIjhJWXwLM

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      887abfad68f4ec1cbf2ea7bd25612f2856d8c5c83df453a1352096367e82f4e0

    • Size

      90KB

    • MD5

      044b8ce73431c25d028f9ab34e3b94de

    • SHA1

      e8aec500e767c9c4f3e1f5c0c48298ced01c321f

    • SHA256

      887abfad68f4ec1cbf2ea7bd25612f2856d8c5c83df453a1352096367e82f4e0

    • SHA512

      1b64146f7b4f730d94e31080baedee3843b674a70bc7080cb61e0f76e74b9a0bbb1002c5e8552132a8a8b0d86ee66420a3fc321a299eec90157df6e65becb5da

    • SSDEEP

      1536:NeeeeKmk8ci8PpOqpgWVbrzQ7ITkZ8A2YaM88ScJWXwkmpM:ei/WVbrzQ7ITkkIjhJWXwLM

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks