Overview

overview

10

Static

static

8

70e86f684f...74.xls

windows7-x64

6

70e86f684f...74.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674

  • Size

    37KB

  • Sample

    240419-fwjzhaag2z

  • MD5

    266ce67ad31b20f92176a0caae1e907e

  • SHA1

    3911cd98904c90bc5c10a02faa4d6a9c60061e07

  • SHA256

    70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674

  • SHA512

    6666953cd10ea0b50f4aedce3ccde83a8f04e4ec2f5c31c9ff9f8cad6dcd8aadb8df0888694a150c5e3ada9fcd92ec80a4981d4ee54ebedd70ed72bc0ce6dd12

  • SSDEEP

    768:6ySCexexjRPD07EKisifs/vlwsEuR1p1MyxTN/DacSvXi32gtmSPzZco:6LVexjRPD07EKisifs/vlwsEuR1p1My9

Score
10/10
macromacro_on_action

Malware Config

Targets

    • Target

      70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674

    • Size

      37KB

    • MD5

      266ce67ad31b20f92176a0caae1e907e

    • SHA1

      3911cd98904c90bc5c10a02faa4d6a9c60061e07

    • SHA256

      70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674

    • SHA512

      6666953cd10ea0b50f4aedce3ccde83a8f04e4ec2f5c31c9ff9f8cad6dcd8aadb8df0888694a150c5e3ada9fcd92ec80a4981d4ee54ebedd70ed72bc0ce6dd12

    • SSDEEP

      768:6ySCexexjRPD07EKisifs/vlwsEuR1p1MyxTN/DacSvXi32gtmSPzZco:6LVexjRPD07EKisifs/vlwsEuR1p1My9

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks