Overview

overview

10

Static

static

8

Z8.xls

windows7-x64

10

Z8.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Z8.xlsm

  • Size

    113KB

  • Sample

    230630-pyvcpacb98

  • MD5

    3e47f75fb9dbb067e2b47049666fc1d2

  • SHA1

    df51ed9b3c9bc6bbef920f2de3bedeccda5217c3

  • SHA256

    aa65a34067b0c50e89c1078d0c7ff08de43e5036241404574f846265de6ff6bd

  • SHA512

    878839b9037053905384417e505741ef74622804eb384f84d1cd1b8b96eb8b0521d6f248f5a9ae635c2367cab17669db248156ef0ca5f11d6a54f3adc0d118eb

  • SSDEEP

    3072:RKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgKFyVEdBU6hubsll6UQjvxp:RKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg2A

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://ordinateur.ogivart.us/editor/Qpo7OAOnbe/
xlm40.dropper

http://old.liceum9.ru/images/0/
xlm40.dropper

http://ostadsarma.com/wp-admin/pYk64Hh3z5hjnMziZ/

Targets

    • Target

      Z8.xlsm

    • Size

      113KB

    • MD5

      3e47f75fb9dbb067e2b47049666fc1d2

    • SHA1

      df51ed9b3c9bc6bbef920f2de3bedeccda5217c3

    • SHA256

      aa65a34067b0c50e89c1078d0c7ff08de43e5036241404574f846265de6ff6bd

    • SHA512

      878839b9037053905384417e505741ef74622804eb384f84d1cd1b8b96eb8b0521d6f248f5a9ae635c2367cab17669db248156ef0ca5f11d6a54f3adc0d118eb

    • SSDEEP

      3072:RKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgKFyVEdBU6hubsll6UQjvxp:RKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg2A

    Score
    10/10
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks