Overview

overview

10

Static

static

8

68fded479f...b8.xls

windows7-x64

10

68fded479f...b8.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68fded479f0aa3ccf1ecc4c95500eb42ab491a384462ea8afbab8a003650acb8

  • Size

    109KB

  • Sample

    250316-1bx1vazxbz

  • MD5

    bd37d42a1c299f861e875b149ba63155

  • SHA1

    0d61bf349b86b4498ec82e8a1ed96e5bf743ffba

  • SHA256

    68fded479f0aa3ccf1ecc4c95500eb42ab491a384462ea8afbab8a003650acb8

  • SHA512

    709db30be0ff454c00519957138352602390c3b110e6ab8cbd505d73c3594894ea1e1072ef0c85b941b5b9cf07721a063b7349658ae310712ae34dd59d594a2a

  • SSDEEP

    1536:2eeeeq8nw8wzQzJtV8cbsQvPe8k1SUmZ9584fsSZWVbrzQ7Iu4kQx23SKUcJtXw8:NCWVbrzQ7INk3JXJtXw8

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      68fded479f0aa3ccf1ecc4c95500eb42ab491a384462ea8afbab8a003650acb8

    • Size

      109KB

    • MD5

      bd37d42a1c299f861e875b149ba63155

    • SHA1

      0d61bf349b86b4498ec82e8a1ed96e5bf743ffba

    • SHA256

      68fded479f0aa3ccf1ecc4c95500eb42ab491a384462ea8afbab8a003650acb8

    • SHA512

      709db30be0ff454c00519957138352602390c3b110e6ab8cbd505d73c3594894ea1e1072ef0c85b941b5b9cf07721a063b7349658ae310712ae34dd59d594a2a

    • SSDEEP

      1536:2eeeeq8nw8wzQzJtV8cbsQvPe8k1SUmZ9584fsSZWVbrzQ7Iu4kQx23SKUcJtXw8:NCWVbrzQ7INk3JXJtXw8

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks