Overview

overview

10

Static

static

8

file3101.xls

windows7_x64

10

file3101.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file3101.xls
  • Size 134KB
  • Sample220131-vvaf1aagg6
  • SHA256 501d0c031e413bc3abe93198d5d94db766729094634adfd29df1200fe762a83f
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://tastedonline.com/cgi-bin/14Lg3P2Dt3rqBmaYZO/
  • exe.dropper

    http://store.anicyber.com/wp-content/0JIWtpJt681mQ/
  • exe.dropper

    http://jeffreylubin.igclout.com/wp-admin/gJ5oDbi/
  • exe.dropper

    https://dulichkhampha24.net/wp-content/rPThO/
  • exe.dropper

    http://dev.learncaraudio.com/wp-admin/ZIwWVcNiED4JYqnq/
  • exe.dropper

    http://karensgardentips.com/cgi-bin/w9i3PIVDOJDeF095ST/
  • exe.dropper

    http://stancewheels.com/wp-admin/ur031GNgTubBSslqN/
  • exe.dropper

    http://laohange.com/wp-content/brPqH/
  • exe.dropper

    http://139.99.89.211/wp-admin/VM1HRb3b0MGGdp/
  • exe.dropper

    http://onexone.elementor.cloud/cdrxhrt/632SFiWmT1Y/

Targets

    • Target
      file3101.xls
    • Size 134KB
    • SHA256 501d0c031e413bc3abe93198d5d94db766729094634adfd29df1200fe762a83f
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks