Overview

overview

10

Static

static

8

vvv.xlsm

windows7-x64

10

vvv.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vvv.sample

  • Size

    328KB

  • Sample

    230719-q1sgjsha3z

  • MD5

    e5b6bf1c7ead9f74dc763021ce195b42

  • SHA1

    1a759d31f0c6d8b1f5e3dd389bc78d2c20718e82

  • SHA256

    04b46a5cf4add15d6d3bf71449ee547eac6d84c841daf418dbb47b00a4361af5

  • SHA512

    c1cf06d29a1a1a3aa6505abdc51908373707790c5eeac3d9ad58393ba7e698d453d1a2f260da107453d8ee4f3c2cb148c3ae0a9f7f90bfb9d37b093acee88f11

  • SSDEEP

    6144:eRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNPQ:eRMmEv2Bc/nvm8IKABfsYOmauFzQ

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://193.203.202.55/44300,5396033565.dat
xlm40.dropper

http://190.14.37.245/44300,5396033565.dat
xlm40.dropper

http://194.67.214.216/44300,5396033565.dat

Targets

    • Target

      vvv.sample

    • Size

      328KB

    • MD5

      e5b6bf1c7ead9f74dc763021ce195b42

    • SHA1

      1a759d31f0c6d8b1f5e3dd389bc78d2c20718e82

    • SHA256

      04b46a5cf4add15d6d3bf71449ee547eac6d84c841daf418dbb47b00a4361af5

    • SHA512

      c1cf06d29a1a1a3aa6505abdc51908373707790c5eeac3d9ad58393ba7e698d453d1a2f260da107453d8ee4f3c2cb148c3ae0a9f7f90bfb9d37b093acee88f11

    • SSDEEP

      6144:eRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNPQ:eRMmEv2Bc/nvm8IKABfsYOmauFzQ

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks