General
-
Target
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3
-
Size
43KB
-
Sample
220125-sggbaahge8
-
MD5
a7e497f572dd9457ac087b47b44ad777
-
SHA1
d378dd3e22784b280b5782d0e2723c7ce15438d1
-
SHA256
86c788ff80127c36aa5b65e4a8be3f06d2783ba24df7d02a16bcd1388a209dc8
-
SHA512
87085e8b1bb0ab1ddc9aedcac34863044360dbac80923103af4e4ba0b1e8c56ddcedd7cf1ba18a5e04554e02893cec93f372e5dbb58c47b45ff2fc2b9058a6c9
Behavioral task
behavioral1
Sample
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3.xls
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3.xls
Resource
win10-en-20211208
Malware Config
Extracted
http://0xb907d607/fer/fe2.html
Targets
-
-
Target
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3
-
Size
70KB
-
MD5
74ef2589b372f105b31d69b352aec951
-
SHA1
2f12a5d662ee51bf73e7ddc2e04c7c018f367e36
-
SHA256
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3
-
SHA512
a5b2124f45034be6c2450a0623439fddf8251f431057ab004da9601f07f814ff6a5db6dbd74f09486ee5ed129a7c514effb999db0181161acaee856f529c7c4b
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-