Overview

overview

10

Static

static

8

020b5ecc0e...30.xls

windows7_x64

10

020b5ecc0e...30.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    020b5ecc0e077344f7eafb0b80fedd30
  • Size 127KB
  • Sample220118-mz5tpsagf4
  • SHA256 5b375b073c39b03e9ccf40dc5fa4651bb2e28721896d5abc68a3886e2dd691a7
  • MD5 SHA1 SHA512
Score
10/10
macroxlm

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://0xb907d607/cc.html

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://185.7.214.7/PP91.PNG

Targets

    • Target
      020b5ecc0e077344f7eafb0b80fedd30
    • Size 127KB
    • SHA256 5b375b073c39b03e9ccf40dc5fa4651bb2e28721896d5abc68a3886e2dd691a7
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks