Overview

overview

10

Static

static

8

tmpf2xuur34.xls

windows7_x64

10

tmpf2xuur34.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpf2xuur34
  • Size 134KB
  • Sample220131-vbnvaaaeg7
  • SHA256 c17ec35c04e7920d99efb5efbdfaf59c7c944d4063e63a4426eccccbf82f5596
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://tastedonline.com/cgi-bin/14Lg3P2Dt3rqBmaYZO/
  • exe.dropper

    http://store.anicyber.com/wp-content/0JIWtpJt681mQ/
  • exe.dropper

    http://jeffreylubin.igclout.com/wp-admin/gJ5oDbi/
  • exe.dropper

    https://dulichkhampha24.net/wp-content/rPThO/
  • exe.dropper

    http://dev.learncaraudio.com/wp-admin/ZIwWVcNiED4JYqnq/
  • exe.dropper

    http://karensgardentips.com/cgi-bin/w9i3PIVDOJDeF095ST/
  • exe.dropper

    http://stancewheels.com/wp-admin/ur031GNgTubBSslqN/
  • exe.dropper

    http://laohange.com/wp-content/brPqH/
  • exe.dropper

    http://139.99.89.211/wp-admin/VM1HRb3b0MGGdp/
  • exe.dropper

    http://onexone.elementor.cloud/cdrxhrt/632SFiWmT1Y/

Targets

    • Target
      tmpf2xuur34
    • Size 134KB
    • SHA256 c17ec35c04e7920d99efb5efbdfaf59c7c944d4063e63a4426eccccbf82f5596
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks