Overview

overview

10

Static

static

8

7c4b32f964...b9.xls

windows7-x64

10

7c4b32f964...b9.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c4b32f964b516b90ce762dbbc2e7f64d6ad0e69fbc2379037d61e15b642d1b9

  • Size

    37KB

  • Sample

    240824-z5kf6ssakq

  • MD5

    f42025a6593369739ee8c6c6b94d7842

  • SHA1

    114fefebfeecaf4eb991556d48aabbfe1d7274a2

  • SHA256

    7c4b32f964b516b90ce762dbbc2e7f64d6ad0e69fbc2379037d61e15b642d1b9

  • SHA512

    0aea9b2810c98cccc9afa5ceba0270be4807f55abd4789915c31fb852b09f1e9f752b110ea3a5222de73679276c4f8e635ff49c8093eb16341e65cc81ea44906

  • SSDEEP

    768:lYq/mRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJqNQ+zt+AmciQ:fck3hbdlylKsgqopeJBWhZFGkE+cL2Nw

Score
10/10
discoveryexecutionmacromacro_on_action

Malware Config

Targets

    • Target

      7c4b32f964b516b90ce762dbbc2e7f64d6ad0e69fbc2379037d61e15b642d1b9

    • Size

      37KB

    • MD5

      f42025a6593369739ee8c6c6b94d7842

    • SHA1

      114fefebfeecaf4eb991556d48aabbfe1d7274a2

    • SHA256

      7c4b32f964b516b90ce762dbbc2e7f64d6ad0e69fbc2379037d61e15b642d1b9

    • SHA512

      0aea9b2810c98cccc9afa5ceba0270be4807f55abd4789915c31fb852b09f1e9f752b110ea3a5222de73679276c4f8e635ff49c8093eb16341e65cc81ea44906

    • SSDEEP

      768:lYq/mRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJqNQ+zt+AmciQ:fck3hbdlylKsgqopeJBWhZFGkE+cL2Nw

    Score
    10/10
    discoveryexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks