Overview

overview

10

Static

static

8

02d62723ac...41.xls

windows7_x64

10

02d62723ac...41.xls

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    02d62723ac6fc8cb5ea31ecd5d822f41
  • Size 61KB
  • Sample211223-rnfgwsagdp
  • SHA256 4fe65c13808d8fc349cd60fec4ff4891272efe6201b7f09157c3347d9fdde210
  • MD5 SHA1 SHA512
Score
10/10
macroxlm

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://87.251.86.178/pp/oo.html

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://87.251.86.178/pp/PP.PNG

Targets

    • Target
      02d62723ac6fc8cb5ea31ecd5d822f41
    • Size 61KB
    • SHA256 4fe65c13808d8fc349cd60fec4ff4891272efe6201b7f09157c3347d9fdde210
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks