General

  • Target

    45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086

  • Size

    115KB

  • Sample

    220120-bmvmesegd2

  • MD5

    d06323156f9db5ba51e46d368bb05b67

  • SHA1

    d3dd5b0885b0a78ff0fbd02acbb95ad7f948fef8

  • SHA256

    45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086

  • SHA512

    8de223a9301b905b5839d021a205c78f96b25140bac40e874a6d60b42e55d5cc20e11ce0b9f89b5bcab3515f366a747f2c9dd6c5d806116df11f84010d7c7dec

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0x5cff39c3/sec/se1.html

Targets

    • Target

      45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086

    • Size

      115KB

    • MD5

      d06323156f9db5ba51e46d368bb05b67

    • SHA1

      d3dd5b0885b0a78ff0fbd02acbb95ad7f948fef8

    • SHA256

      45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086

    • SHA512

      8de223a9301b905b5839d021a205c78f96b25140bac40e874a6d60b42e55d5cc20e11ce0b9f89b5bcab3515f366a747f2c9dd6c5d806116df11f84010d7c7dec

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v6

Tasks