Overview

overview

10

Static

static

8

285f25f358...18.xls

windows7-x64

10

285f25f358...18.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    285f25f3589ee69425f63cea9b6a61b0ef9138eb5824d7db8eee0bb225654c18

  • Size

    63KB

  • Sample

    250325-13ryxattcy

  • MD5

    0f994f9f5a3e4dce57b7a020222ebcd6

  • SHA1

    36c3b7974707d7b8e08765880e08000bfb3f9470

  • SHA256

    285f25f3589ee69425f63cea9b6a61b0ef9138eb5824d7db8eee0bb225654c18

  • SHA512

    9308ee9a63ad2664a07485505d000aa8e171968e19af9992bdadbb1fdbcd016a914a9c7c37b81409c2c86a2dcddeddb74bdef6366d7fcd9cc314b66b81ca1ab1

  • SSDEEP

    1536:zv+km4OrZTPVbJhr1TBL602MCspTZQxEtjPOtioVjDGUU1qfDlaGGx+cL2QnVJ4j:zv+km4OrZbVbJhr1TBL602MCspTZQxEp

Score
10/10
discoveryexecutionmacromacro_on_action

Malware Config

Targets

    • Target

      285f25f3589ee69425f63cea9b6a61b0ef9138eb5824d7db8eee0bb225654c18

    • Size

      63KB

    • MD5

      0f994f9f5a3e4dce57b7a020222ebcd6

    • SHA1

      36c3b7974707d7b8e08765880e08000bfb3f9470

    • SHA256

      285f25f3589ee69425f63cea9b6a61b0ef9138eb5824d7db8eee0bb225654c18

    • SHA512

      9308ee9a63ad2664a07485505d000aa8e171968e19af9992bdadbb1fdbcd016a914a9c7c37b81409c2c86a2dcddeddb74bdef6366d7fcd9cc314b66b81ca1ab1

    • SSDEEP

      1536:zv+km4OrZTPVbJhr1TBL602MCspTZQxEtjPOtioVjDGUU1qfDlaGGx+cL2QnVJ4j:zv+km4OrZbVbJhr1TBL602MCspTZQxEp

    Score
    10/10
    discoveryexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks