Overview

overview

10

Static

static

8

tmp7ryfk6fz.xls

windows7_x64

10

tmp7ryfk6fz.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmp7ryfk6fz
  • Size 134KB
  • Sample220131-vhgdsaafd9
  • SHA256 ac558a9ffffe16fb7e71fdd95c1b1a9e6f438e7b05ee7f9b38755f417073e299
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://mytelefonist.de/wp-content/bLm8fxV2M/
  • exe.dropper

    https://www.yeald.finance/wp-content/uploads/jqAorV83quhL23HMg/
  • exe.dropper

    http://tattooblog.cn/wp-includes/7AvyW/
  • exe.dropper

    http://docs-construction.com/wp-admin/jDDqg/
  • exe.dropper

    http://sep.dfwsolar.club/hzh3v/poAgyopszuh6a1EIG/
  • exe.dropper

    http://b-lubisi-motivational-speaker.com/wp-admin/Wf5rQabNRai/
  • exe.dropper

    https://pmfstukm.com/wp-admin/SoenE35FXJBjVdnfME/
  • exe.dropper

    http://sesco-ks.com/wp-content/DJkMVMU6cBr45/
  • exe.dropper

    https://sangwin.in/magnisapiente/UzYqb1lvgq/
  • exe.dropper

    http://actividades.laforetlanguages.com/wp-admin/OfFq/

Targets

    • Target
      tmp7ryfk6fz
    • Size 134KB
    • SHA256 ac558a9ffffe16fb7e71fdd95c1b1a9e6f438e7b05ee7f9b38755f417073e299
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks