Overview

overview

10

Static

static

8

County Pay...26.xls

windows7-x64

10

County Pay...26.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f663c3bff1ac1034269ea51d5f01f982773e6e40ae397d8fb6c0fa4ae627181b

  • Size

    43KB

  • Sample

    241120-zb6sbaspgt

  • MD5

    b793d76e9007e6e0cf92a6e7482c0311

  • SHA1

    0c6b4ddbb49c8d0b4b6ef5bc97ffbc379c629002

  • SHA256

    f663c3bff1ac1034269ea51d5f01f982773e6e40ae397d8fb6c0fa4ae627181b

  • SHA512

    f60ecf70b7519e4eeaf3ec963855ce378284fdb52f3899b3546a86279c2676e4617802c8549a7e90c1cdb578b564df7f5d2b9d007521dee4b768b4f748713ab0

  • SSDEEP

    768:cjkt9NNt50LUWnaLCIS8fEcTYn6SwsiN1xNOMG3s85sIv2Csqls5:c4pNt50LUWnaNHE9lZiNTEZ3XYz8Q

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.vinyz.com/cache/rqWV/
xlm40.dropper

http://yuanliao.raluking.com/1eq5o7/gHrTM8YilZz0quKt/
xlm40.dropper

https://akarweb.net/cgi-bin/CL13tGXI/
xlm40.dropper

http://www.bdbg.es/css/DDm7o71vWtTs/

Targets

    • Target

      County Payment Report - 2022-11-10_1226.xls

    • Size

      91KB

    • MD5

      7c517fc0f713609f740d375ecfb33108

    • SHA1

      736006fb5cc695be518b49bacc128bad5888e272

    • SHA256

      3959e0f2ce9b4b6976ec5f51d95aa661c26000878daecf0e68803145d9f70b40

    • SHA512

      0bbcf46e0b70e05f28994c1993f0ad7ceecc7c21a52587426adc569b7cb54d40408d85efc6ee2d3de97a3b6f1b71cedd899a5b80c64fe004f8355bfc15af70dc

    • SSDEEP

      1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4bCXuZH4gb4CEn9J4ZjrX:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgs

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks