Overview

overview

10

Static

static

8

4dc9b2f115...c.xlsm

windows7-x64

10

4dc9b2f115...c.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4dc9b2f11546e5bf8fb9901809a0707ff1e23acdc52742b991ddff18ce03733c.zip

  • Size

    176KB

  • Sample

    230311-tbvgdsac99

  • MD5

    c67ec00689f65b2155ee55d0be7a5c5b

  • SHA1

    43a755be4fe893b93f3b95493c15baa824786e1f

  • SHA256

    7074e8079eac03c679722f4ef4613a4d6bbad0fdfd7485cee77b9038c49a1038

  • SHA512

    26c1177ab923656b170c576ce80dbd1fe1564a5cb76bf1799a30539e5d645f298e8b8f9655e9d232a837634da710d7f1625312001acc27fc8d4b50a35e71581c

  • SSDEEP

    3072:UKGboxn8kqDTHEhwMh1gjqITh1ZVkyA190AbqHnsqhXyCfgkh5NhAYaWLDZGE:RR8bTkyMUsfoXHscNqYZ9

Score
10/10
macro

Malware Config

Targets

    • Target

      4dc9b2f11546e5bf8fb9901809a0707ff1e23acdc52742b991ddff18ce03733c.xlsx

    • Size

      180KB

    • MD5

      b876d6897e25db661b02a79c2e68eb0d

    • SHA1

      f7743ba186492f6cb788837ec510a79999ef951c

    • SHA256

      4dc9b2f11546e5bf8fb9901809a0707ff1e23acdc52742b991ddff18ce03733c

    • SHA512

      751e0a259c3fe773afe37938cf3e3b476d9357c71ebfa922b4da0a2b617b332d8ac43e194b708b621d0a0863beabb57581071362d20208dd4893214d33182848

    • SSDEEP

      3072:BfX1i6uPN1bVcrA7ZHLygMa6HNKb3VzH2nIZ3IfTVR90YTH9tIaZ5UbjlUbV055E:BfX1i6e3bVCQhLvMBHNKLVWwm2m9tIoh

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks