Overview

overview

10

Static

static

8

galadriel

windows7_x64

10

Resubmissions

15-01-2021 09:25

210115-5vdjdbqvxe 10

15-01-2021 07:47

210115-5yp4gybvjn 10

15-01-2021 07:12

210115-nekg7v4ybs 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Your order YL5088844988 13-01-2021.doc

  • Size

    92KB

  • Sample

    210115-5vdjdbqvxe

  • MD5

    390cc36367632b99404bc3c610a83441

  • SHA1

    fdf27a70464fd442f858364503da83d64c48b686

  • SHA256

    fee13caa4b47e7859ada7207507b9d385aee0e14412cc738fed9465078ed2696

  • SHA512

    97a6868edf1534445a89ff13decaf694ac458a91253d6c7341d97bd7fe0d9e428a1cfe75b1144ab457106c7f38938a18cc530576c9c16c75b40ff35883b92a35

Score
10/10
macroxlm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://tmsvinhphuc.com/wp-content/SpeechEngines/
exe.dropper

http://huzurdugunsalonu.com/wp-content/Speech/
exe.dropper

http://personal.unicorp.site/lang/System_32/
exe.dropper

http://christinewalker.org/wp-admin/Xt9SNHtExU/
exe.dropper

http://www.3d.unicorp.site/js/GzVpMLaH/
exe.dropper

http://3d.unicorp.site/js/A1ew/

Targets

    • Target

      Your order YL5088844988 13-01-2021.doc

    • Size

      92KB

    • MD5

      390cc36367632b99404bc3c610a83441

    • SHA1

      fdf27a70464fd442f858364503da83d64c48b686

    • SHA256

      fee13caa4b47e7859ada7207507b9d385aee0e14412cc738fed9465078ed2696

    • SHA512

      97a6868edf1534445a89ff13decaf694ac458a91253d6c7341d97bd7fe0d9e428a1cfe75b1144ab457106c7f38938a18cc530576c9c16c75b40ff35883b92a35

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks