Overview

overview

10

Static

static

8

tmp9nqfoqpr.xls

windows7_x64

10

tmp9nqfoqpr.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmp9nqfoqpr
  • Size 134KB
  • Sample220131-welprsbbc9
  • SHA256 d39c8bf783fc8d74fd0a3018e9a8c3595fa21222eb5e3528acf9f57718171c59
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://tastedonline.com/cgi-bin/14Lg3P2Dt3rqBmaYZO/
  • exe.dropper

    http://store.anicyber.com/wp-content/0JIWtpJt681mQ/
  • exe.dropper

    http://jeffreylubin.igclout.com/wp-admin/gJ5oDbi/
  • exe.dropper

    https://dulichkhampha24.net/wp-content/rPThO/
  • exe.dropper

    http://dev.learncaraudio.com/wp-admin/ZIwWVcNiED4JYqnq/
  • exe.dropper

    http://karensgardentips.com/cgi-bin/w9i3PIVDOJDeF095ST/
  • exe.dropper

    http://stancewheels.com/wp-admin/ur031GNgTubBSslqN/
  • exe.dropper

    http://laohange.com/wp-content/brPqH/
  • exe.dropper

    http://139.99.89.211/wp-admin/VM1HRb3b0MGGdp/
  • exe.dropper

    http://onexone.elementor.cloud/cdrxhrt/632SFiWmT1Y/

Targets

    • Target
      tmp9nqfoqpr
    • Size 134KB
    • SHA256 d39c8bf783fc8d74fd0a3018e9a8c3595fa21222eb5e3528acf9f57718171c59
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks