Overview

overview

10

Static

static

8

0f73dbeb1b...67.xls

windows7-x64

10

0f73dbeb1b...67.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f73dbeb1b26f2c56ebcfebc474d3b67

  • Size

    96KB

  • Sample

    230314-kvy49age8t

  • MD5

    0f73dbeb1b26f2c56ebcfebc474d3b67

  • SHA1

    81b429aa3de792d4a1ff5f6e2186483016fbeaab

  • SHA256

    7f1fa449a2eb33db85034f064b4c1b9a02716be5d37b5834b41157b78e4286ce

  • SHA512

    c8253bf6ab71c8af35984b744bc0b3e57355fa968acd8eb7177e52b574e65630d71b39bf55053a02c31083f75dfee3b60a7afe86e056f3165bbc0b501533881f

  • SSDEEP

    1536:WQQQWh8teVQczsQ8PzS1bLvJkqeV+yEGTeHByDoP12jcc0lbxOvTgZgm/M10QWK+:nxC12jcc0lbxOrinJtXwz

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      0f73dbeb1b26f2c56ebcfebc474d3b67

    • Size

      96KB

    • MD5

      0f73dbeb1b26f2c56ebcfebc474d3b67

    • SHA1

      81b429aa3de792d4a1ff5f6e2186483016fbeaab

    • SHA256

      7f1fa449a2eb33db85034f064b4c1b9a02716be5d37b5834b41157b78e4286ce

    • SHA512

      c8253bf6ab71c8af35984b744bc0b3e57355fa968acd8eb7177e52b574e65630d71b39bf55053a02c31083f75dfee3b60a7afe86e056f3165bbc0b501533881f

    • SSDEEP

      1536:WQQQWh8teVQczsQ8PzS1bLvJkqeV+yEGTeHByDoP12jcc0lbxOvTgZgm/M10QWK+:nxC12jcc0lbxOrinJtXwz

    Score
    10/10
    macroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks