Overview

overview

10

Static

static

8

a53a96d261...25.xls

windows7-x64

10

a53a96d261...25.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a53a96d26186ea3c09d845ebf6bdad25

  • Size

    133KB

  • Sample

    230314-ksxteaee44

  • MD5

    a53a96d26186ea3c09d845ebf6bdad25

  • SHA1

    b25393321687bf24dd3c7016f9642d097e9c425c

  • SHA256

    c4d69fbcd35b96a817b486c346e8e2a07c3fad79f921c29385c508e2fd7a152f

  • SHA512

    64b0407b89429b5fd2014fe988d4408d4e36eaf0eab760f3036aa1750b71aa99e607c9412fafcd1b6202bfcfda87d53c7c0c8ffb95e50bcc1919e7cf6aa17b18

  • SSDEEP

    1536:mQQQQcF9NpLA6+IfWVbrzBh7ITkR620LkMg+cJtXweKVv4gS/rpMmm:lfWVbrzH7ITk9/H9JtXwlv4ll9m

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      a53a96d26186ea3c09d845ebf6bdad25

    • Size

      133KB

    • MD5

      a53a96d26186ea3c09d845ebf6bdad25

    • SHA1

      b25393321687bf24dd3c7016f9642d097e9c425c

    • SHA256

      c4d69fbcd35b96a817b486c346e8e2a07c3fad79f921c29385c508e2fd7a152f

    • SHA512

      64b0407b89429b5fd2014fe988d4408d4e36eaf0eab760f3036aa1750b71aa99e607c9412fafcd1b6202bfcfda87d53c7c0c8ffb95e50bcc1919e7cf6aa17b18

    • SSDEEP

      1536:mQQQQcF9NpLA6+IfWVbrzBh7ITkR620LkMg+cJtXweKVv4gS/rpMmm:lfWVbrzH7ITk9/H9JtXwlv4ll9m

    Score
    10/10
    macroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks