Overview

overview

10

Static

static

8

322ee1a8d7...f1.xls

windows7-x64

10

322ee1a8d7...f1.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1

  • Size

    36KB

  • Sample

    230129-x272yscb5x

  • MD5

    7a51d386c11748d3b2c56d58d204089e

  • SHA1

    8ce3cadda1112c2615190ea3047bc2608e3c1b3a

  • SHA256

    322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1

  • SHA512

    a61f91adb9a12e02a9c55aa01fd62a194830861a2c308b0b91fe7e01ce8bdf81d8f86d8b8a61a586ecd30339b7d23765b49c9dd97b8d90c6c9a035acbdc62b9d

  • SSDEEP

    768:OPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJS2VfcbFfIJTM2pKUglou0C:yok3hbdlylKsgqopeJBWhZFGkE+cL2NV

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://statedauto.com/wp-data.php

Targets

    • Target

      322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1

    • Size

      36KB

    • MD5

      7a51d386c11748d3b2c56d58d204089e

    • SHA1

      8ce3cadda1112c2615190ea3047bc2608e3c1b3a

    • SHA256

      322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1

    • SHA512

      a61f91adb9a12e02a9c55aa01fd62a194830861a2c308b0b91fe7e01ce8bdf81d8f86d8b8a61a586ecd30339b7d23765b49c9dd97b8d90c6c9a035acbdc62b9d

    • SSDEEP

      768:OPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJS2VfcbFfIJTM2pKUglou0C:yok3hbdlylKsgqopeJBWhZFGkE+cL2NV

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks