Overview

overview

10

Static

static

8

e6e59fd682...31.doc

windows7_x64

10

e6e59fd682...31.doc

windows10_x64

10

Resubmissions

21/12/2020, 16:05

201221-63d1a5ry2n10

21/12/2020, 16:04

201221-w6dwvwcaza10

21/12/2020, 12:05

201221-8c6wmat6kx10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5750416374792192.zip
  • Size 93KB
  • Sample201221-63d1a5ry2n
  • SHA256 a5b510a8622fa550ad9b0a48d4201e286b1f446aa6fb78c5b4274c11a07ff4d0
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://parakkunnathtemple.com/bckup/7SDAvi/
  • exe.dropper

    http://helionspharmaceutical.com/wp-admin/oXJB/
  • exe.dropper

    https://accordiblehr.com/wp-admin/HdzyEn/
  • exe.dropper

    https://snjwellers.com/wp-includes/esttW/
  • exe.dropper

    https://norailya.com/vendor/1j/
  • exe.dropper

    https://whytech.info/wp-includes/HceUxFK/
  • exe.dropper

    http://resuco.net/wp-content/uploads/2020/12/S0K/

Targets

    • Target
      e6e59fd682d1212c1b789365f92e5a5e778ca20f2d16440ec6f5b46ddb85d431
    • Size 190KB
    • SHA256 e6e59fd682d1212c1b789365f92e5a5e778ca20f2d16440ec6f5b46ddb85d431
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks