Overview

overview

10

Static

static

8

0d540607ea...22.xls

windows7-x64

10

0d540607ea...22.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d540607ea5a4d3b0d5406cb099ce922

  • Size

    133KB

  • Sample

    230314-ktjm6sge7t

  • MD5

    0d540607ea5a4d3b0d5406cb099ce922

  • SHA1

    7abeb4ae0fcdfcdd623eca794a1b67c332a40ae6

  • SHA256

    f534e9396e321bc78a3a017a5aeaff83149bd8d9b12a115e01b4dc664115651a

  • SHA512

    ce6cd738626f321097a1ab2047e3a09a5ff5978af154c8e9aeafe4ca7cc288a30a3fd2bbdf3076f8f063d770c40849e524f06ee6232f05b35ee3511dc51c8439

  • SSDEEP

    1536:jQQQQcF9NpLA6+IfWVbrzBh7ITkR620LkMg+cJtXweKVv4gS/rpMmm:4fWVbrzH7ITk9/H9JtXwlv4ll9m

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      0d540607ea5a4d3b0d5406cb099ce922

    • Size

      133KB

    • MD5

      0d540607ea5a4d3b0d5406cb099ce922

    • SHA1

      7abeb4ae0fcdfcdd623eca794a1b67c332a40ae6

    • SHA256

      f534e9396e321bc78a3a017a5aeaff83149bd8d9b12a115e01b4dc664115651a

    • SHA512

      ce6cd738626f321097a1ab2047e3a09a5ff5978af154c8e9aeafe4ca7cc288a30a3fd2bbdf3076f8f063d770c40849e524f06ee6232f05b35ee3511dc51c8439

    • SSDEEP

      1536:jQQQQcF9NpLA6+IfWVbrzBh7ITkR620LkMg+cJtXweKVv4gS/rpMmm:4fWVbrzH7ITk9/H9JtXwlv4ll9m

    Score
    10/10
    macroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks