General

  • Target

    561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3

  • Size

    43KB

  • Sample

    220125-sggbaahge8

  • MD5

    a7e497f572dd9457ac087b47b44ad777

  • SHA1

    d378dd3e22784b280b5782d0e2723c7ce15438d1

  • SHA256

    86c788ff80127c36aa5b65e4a8be3f06d2783ba24df7d02a16bcd1388a209dc8

  • SHA512

    87085e8b1bb0ab1ddc9aedcac34863044360dbac80923103af4e4ba0b1e8c56ddcedd7cf1ba18a5e04554e02893cec93f372e5dbb58c47b45ff2fc2b9058a6c9

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0xb907d607/fer/fe2.html

Targets

    • Target

      561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3

    • Size

      70KB

    • MD5

      74ef2589b372f105b31d69b352aec951

    • SHA1

      2f12a5d662ee51bf73e7ddc2e04c7c018f367e36

    • SHA256

      561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3

    • SHA512

      a5b2124f45034be6c2450a0623439fddf8251f431057ab004da9601f07f814ff6a5db6dbd74f09486ee5ed129a7c514effb999db0181161acaee856f529c7c4b

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v6

Tasks