Overview

overview

10

Static

static

1

cc4755c23a...2.xlsx

windows7-x64

10

cc4755c23a...2.xlsx

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    cc4755c23a3c26dadacbc2000b8d10f905cb9c55946404bdd3da6738a6902e82

  • Size

    1.4MB

  • Sample

    240913-1fc68s1bpa

  • MD5

    031c004b58eec75f43ab8f56a9522160

  • SHA1

    011475393b0b2d65cdda516deb12846031c8dfbc

  • SHA256

    cc4755c23a3c26dadacbc2000b8d10f905cb9c55946404bdd3da6738a6902e82

  • SHA512

    3fcd72f04516d414ec6083d5e4eeac3d004b14b131a7082c3541e1d41c1fc62409d9b7ec62700f5e1f137b517bfd8c9a27b5909315c399e711f64c230407bdbe

  • SSDEEP

    24576:Lj9AIH91L1f1yNlX5UHT/fc3bOwkMugKQe5QCiiGR4EJ/HY3/SkGA4KXuj+pg72K:uIDL1f1qXmHTXwPupQe5QCiiGFHQ/SaK

Score
10/10
credential_accessdiscoverystealer

Malware Config

Targets

    • Target

      cc4755c23a3c26dadacbc2000b8d10f905cb9c55946404bdd3da6738a6902e82

    • Size

      1.4MB

    • MD5

      031c004b58eec75f43ab8f56a9522160

    • SHA1

      011475393b0b2d65cdda516deb12846031c8dfbc

    • SHA256

      cc4755c23a3c26dadacbc2000b8d10f905cb9c55946404bdd3da6738a6902e82

    • SHA512

      3fcd72f04516d414ec6083d5e4eeac3d004b14b131a7082c3541e1d41c1fc62409d9b7ec62700f5e1f137b517bfd8c9a27b5909315c399e711f64c230407bdbe

    • SSDEEP

      24576:Lj9AIH91L1f1yNlX5UHT/fc3bOwkMugKQe5QCiiGR4EJ/HY3/SkGA4KXuj+pg72K:uIDL1f1qXmHTXwPupQe5QCiiGFHQ/SaK

    Score
    10/10
    credential_accessdiscoverystealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks