Overview

overview

10

Static

static

8

tmpc2fk8f8u.xls

windows7_x64

10

tmpc2fk8f8u.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpc2fk8f8u
  • Size 134KB
  • Sample220131-vkrmjaafg6
  • SHA256 ee4c35cdb0f34223bab8cbe0e95aa6f348ceb97b6dade6099e97631636e48362
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://mytelefonist.de/wp-content/bLm8fxV2M/
  • exe.dropper

    https://www.yeald.finance/wp-content/uploads/jqAorV83quhL23HMg/
  • exe.dropper

    http://tattooblog.cn/wp-includes/7AvyW/
  • exe.dropper

    http://docs-construction.com/wp-admin/jDDqg/
  • exe.dropper

    http://sep.dfwsolar.club/hzh3v/poAgyopszuh6a1EIG/
  • exe.dropper

    http://b-lubisi-motivational-speaker.com/wp-admin/Wf5rQabNRai/
  • exe.dropper

    https://pmfstukm.com/wp-admin/SoenE35FXJBjVdnfME/
  • exe.dropper

    http://sesco-ks.com/wp-content/DJkMVMU6cBr45/
  • exe.dropper

    https://sangwin.in/magnisapiente/UzYqb1lvgq/
  • exe.dropper

    http://actividades.laforetlanguages.com/wp-admin/OfFq/

Targets

    • Target
      tmpc2fk8f8u
    • Size 134KB
    • SHA256 ee4c35cdb0f34223bab8cbe0e95aa6f348ceb97b6dade6099e97631636e48362
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks