Overview

overview

10

Static

static

8

attachments239773.xls

windows7_x64

10

attachments239773.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    attachments239773.xls
  • Size 134KB
  • Sample220131-vemfmaafb9
  • SHA256 ab90ee4eaeea25da435ba296d641bbbae5130d2a117acf3990268b3b5353659c
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://tastedonline.com/cgi-bin/14Lg3P2Dt3rqBmaYZO/
  • exe.dropper

    http://store.anicyber.com/wp-content/0JIWtpJt681mQ/
  • exe.dropper

    http://jeffreylubin.igclout.com/wp-admin/gJ5oDbi/
  • exe.dropper

    https://dulichkhampha24.net/wp-content/rPThO/
  • exe.dropper

    http://dev.learncaraudio.com/wp-admin/ZIwWVcNiED4JYqnq/
  • exe.dropper

    http://karensgardentips.com/cgi-bin/w9i3PIVDOJDeF095ST/
  • exe.dropper

    http://stancewheels.com/wp-admin/ur031GNgTubBSslqN/
  • exe.dropper

    http://laohange.com/wp-content/brPqH/
  • exe.dropper

    http://139.99.89.211/wp-admin/VM1HRb3b0MGGdp/
  • exe.dropper

    http://onexone.elementor.cloud/cdrxhrt/632SFiWmT1Y/

Targets

    • Target
      attachments239773.xls
    • Size 134KB
    • SHA256 ab90ee4eaeea25da435ba296d641bbbae5130d2a117acf3990268b3b5353659c
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks