Overview

overview

10

Static

static

8

e4454c0038...71.xls

windows7-x64

10

e4454c0038...71.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4454c0038cd23ee5b4b082d88097f7c74b23b0d2b098b48b04228d081bdc671

  • Size

    134KB

  • Sample

    240515-cp2desce2v

  • MD5

    b1900ea0e41925813c51e507236f43d7

  • SHA1

    1fbb006fdfa003e1e85fe92449e17ff2761fc8b6

  • SHA256

    e4454c0038cd23ee5b4b082d88097f7c74b23b0d2b098b48b04228d081bdc671

  • SHA512

    c7d5398ddb77b334aefa72e75e937bda8c12e57eac0a8d1883fe804b61bf0c86d67876665215ac4c9eab02427f397687a90e8fc11c129deeddfb816cc3caf806

  • SSDEEP

    3072:q2Q+A64l7VX1TnRrpXJ0eQm02RxHFk3hOdsylKlgryzc4bNhZFGzE+cL2knmMRfV:q2Q+A64l7VX1TnRrpXJ0eQm02RxHFk3t

Score
10/10
executionmacromacro_on_action

Malware Config

Targets

    • Target

      e4454c0038cd23ee5b4b082d88097f7c74b23b0d2b098b48b04228d081bdc671

    • Size

      134KB

    • MD5

      b1900ea0e41925813c51e507236f43d7

    • SHA1

      1fbb006fdfa003e1e85fe92449e17ff2761fc8b6

    • SHA256

      e4454c0038cd23ee5b4b082d88097f7c74b23b0d2b098b48b04228d081bdc671

    • SHA512

      c7d5398ddb77b334aefa72e75e937bda8c12e57eac0a8d1883fe804b61bf0c86d67876665215ac4c9eab02427f397687a90e8fc11c129deeddfb816cc3caf806

    • SSDEEP

      3072:q2Q+A64l7VX1TnRrpXJ0eQm02RxHFk3hOdsylKlgryzc4bNhZFGzE+cL2knmMRfV:q2Q+A64l7VX1TnRrpXJ0eQm02RxHFk3t

    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks