General

  • Target

    053bb9b9096198d542ba99d4aa0148e9af3797c17d2b874f406bf9d35749d809

  • Size

    110KB

  • Sample

    220120-plxbhsaaa4

  • MD5

    fdba23f96e2a3337048fbd1f116ac128

  • SHA1

    b9599026ed63f455d2cda18ec8dff202170be381

  • SHA256

    053bb9b9096198d542ba99d4aa0148e9af3797c17d2b874f406bf9d35749d809

  • SHA512

    82a691f0c5abaa2a9b56c800b9d405c155e6f5c6cfa80f1f39028ff8ce7e8239ee39cef06686b855c3173c8b4d034a55901280bfb0489e2bfdbebef153a89aa6

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0056.0151.0121.0114/c.html

Targets

    • Target

      053bb9b9096198d542ba99d4aa0148e9af3797c17d2b874f406bf9d35749d809

    • Size

      110KB

    • MD5

      fdba23f96e2a3337048fbd1f116ac128

    • SHA1

      b9599026ed63f455d2cda18ec8dff202170be381

    • SHA256

      053bb9b9096198d542ba99d4aa0148e9af3797c17d2b874f406bf9d35749d809

    • SHA512

      82a691f0c5abaa2a9b56c800b9d405c155e6f5c6cfa80f1f39028ff8ce7e8239ee39cef06686b855c3173c8b4d034a55901280bfb0489e2bfdbebef153a89aa6

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v6

Tasks