Overview

overview

10

Static

static

8

2022-11-12...ed.xls

windows7-x64

10

2022-11-12...ed.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2022-11-12-663e1bfcc66afb5a44b67a298869b521_unzipped.bin

  • Size

    96KB

  • Sample

    230302-qp6vsscg2s

  • MD5

    663e1bfcc66afb5a44b67a298869b521

  • SHA1

    f40f0294d9a6e7ff1b3b1133d56169f0a3ff57a5

  • SHA256

    19fca99f14a377f8bf184747082475c652b176e1d0546130eb4a48f928b8565c

  • SHA512

    90c66070eb50e63745efaa3b31e688444ee9619ac6e0f27c1c65679a26be7e2c79b7d0da81a31598948973057744fde2507c0ec25a8d1b448405a97bb0d9af17

  • SSDEEP

    3072:CKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgyOmH4wbH5t:CKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgyZ

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://web.ferno.sk/wp-content/pWLdtgNRJjGIs4V/
xlm40.dropper

http://www.etelefon.ro/docs/csv_import/Njpcdo0xA8qV5Qik/
xlm40.dropper

http://weathermaps.ir/maps/A8srcXuPMyk6EAbW3/
xlm40.dropper

http://dominionai.org/TI55pT5PYd/VPHWTnzQe/

Targets

    • Target

      2022-11-12-663e1bfcc66afb5a44b67a298869b521_unzipped.bin

    • Size

      96KB

    • MD5

      663e1bfcc66afb5a44b67a298869b521

    • SHA1

      f40f0294d9a6e7ff1b3b1133d56169f0a3ff57a5

    • SHA256

      19fca99f14a377f8bf184747082475c652b176e1d0546130eb4a48f928b8565c

    • SHA512

      90c66070eb50e63745efaa3b31e688444ee9619ac6e0f27c1c65679a26be7e2c79b7d0da81a31598948973057744fde2507c0ec25a8d1b448405a97bb0d9af17

    • SSDEEP

      3072:CKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgyOmH4wbH5t:CKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgyZ

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks