Overview

overview

10

Static

static

HZE944859393UX.xls

windows7_x64

10

HZE944859393UX.xls

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    HZE944859393UX.xls
  • Size 142KB
  • Sample220125-lpcvhadcal
  • SHA256 e328a59f1530bbe5289dd25656f07b9864ccb36c938b7098148c145b5b29e41a
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://rkeeperua.com/include/FXBsVAOd1U/
  • exe.dropper

    http://pozhadvokat.com/images/QmZXA9kRUU8xZZF/
  • exe.dropper

    http://queens.renovatiog.ltd/wp-includes/LDH/
  • exe.dropper

    http://renovatiomarketing.com/renovatiomarketing.com/A/
  • exe.dropper

    http://remedy.eventmasti.com/vendor/Y2XclYoCdDzSSua/
  • exe.dropper

    http://ppdbsma.insanrabbany.sch.id/gkvvb/sXVYo8HsPSFQh/
  • exe.dropper

    http://pinnaclehomesusa.net/870xg9/pNp3a1iHCKaZwYEV/
  • exe.dropper

    http://dandtpremierhomes.com/eapn/lpN6dcAppn/
  • exe.dropper

    http://keluargamalaysia.bliblah.com/cgi-bin/FUzc3KOKN3DNeee/
  • exe.dropper

    http://crisbdev.com/wp-content/2dmXYgLVdkV/

Targets

    • Target
      HZE944859393UX.xls
    • Size 142KB
    • SHA256 e328a59f1530bbe5289dd25656f07b9864ccb36c938b7098148c145b5b29e41a
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks