Overview

overview

10

Static

static

8

8656632045...1.xlsm

windows7_x64

10

8656632045...1.xlsm

windows10_x64

10

Resubmissions

24/11/2021, 17:59

211124-wk8rgsddbm10

22/11/2021, 14:46

211122-r5n6csagd610

22/11/2021, 14:46

211122-r5csbsfgdp10

22/11/2021, 14:44

211122-r4kfsafgdn10

22/11/2021, 14:41

211122-r2x9vsfgcq10

22/11/2021, 14:20

211122-rneklaffgr10

22/11/2021, 14:15

211122-rkk8zaffgl10

17/11/2021, 06:51

211117-hm1l1aeefm10

17/11/2021, 06:37

211117-hdnk3seedn10

Sharing

Copy URL Twitter E-mail

General

  • Target
    865663204559_17_Nov_2021.xlsm
  • Size 44KB
  • Sample211124-wk8rgsddbm
  • SHA256 ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://evgeniys.ru/sap-logs/D6/
  • exe.dropper

    http://crownadvertising.ca/wp-includes/OxiAACCoic/
  • exe.dropper

    https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
  • exe.dropper

    http://immoinvest.com.br/blog_old/wp-admin/luoT/
  • exe.dropper

    https://yoho.love/wp-content/e4laFBDXIvYT6O/
  • exe.dropper

    https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
  • exe.dropper

    https://www.pasionportufuturo.pe/wp-content/XUBS/

Targets

    • Target
      865663204559_17_Nov_2021.xlsm
    • Size 44KB
    • SHA256 ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks