Overview

overview

6

Static

static

dmitry.nos...49.xls

windows7_x64

6

dmitry.nos...49.xls

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dmitry.nosickow-1291249.xls

  • Size

    374KB

  • Sample

    200402-18p2eqprca

  • MD5

    44bb157747e790f6d85cfe9e55f4fa7d

  • SHA1

    f339ac5376e34099d3dba668c052ecf71a9b380f

  • SHA256

    7d3c8394e9a2f66f2d69f3b27d2abd34e0f3725fb4e43e10537ccc77850ada7f

  • SHA512

    16cd1ed985155216aec5bfe90c019224c9a3c2689f11f2aed8fc37c4e9af497fd982c7bd83a974602e508198aaae34e4701494c95cf95d015f3d56bfc87cd544

Score
6/10

Malware Config

Targets

    • Target

      dmitry.nosickow-1291249.xls

    • Size

      374KB

    • MD5

      44bb157747e790f6d85cfe9e55f4fa7d

    • SHA1

      f339ac5376e34099d3dba668c052ecf71a9b380f

    • SHA256

      7d3c8394e9a2f66f2d69f3b27d2abd34e0f3725fb4e43e10537ccc77850ada7f

    • SHA512

      16cd1ed985155216aec5bfe90c019224c9a3c2689f11f2aed8fc37c4e9af497fd982c7bd83a974602e508198aaae34e4701494c95cf95d015f3d56bfc87cd544

    Score
    6/10

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks