Overview

overview

10

Static

static

8

tmp1hh5gocd.xls

windows7_x64

10

tmp1hh5gocd.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmp1hh5gocd
  • Size 134KB
  • Sample220131-wfr8yabbd9
  • SHA256 46736545f69d457a1b302df9a70ecd96aa8768650bb2bb31dbd1e312dc299def
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://tastedonline.com/cgi-bin/14Lg3P2Dt3rqBmaYZO/
  • exe.dropper

    http://store.anicyber.com/wp-content/0JIWtpJt681mQ/
  • exe.dropper

    http://jeffreylubin.igclout.com/wp-admin/gJ5oDbi/
  • exe.dropper

    https://dulichkhampha24.net/wp-content/rPThO/
  • exe.dropper

    http://dev.learncaraudio.com/wp-admin/ZIwWVcNiED4JYqnq/
  • exe.dropper

    http://karensgardentips.com/cgi-bin/w9i3PIVDOJDeF095ST/
  • exe.dropper

    http://stancewheels.com/wp-admin/ur031GNgTubBSslqN/
  • exe.dropper

    http://laohange.com/wp-content/brPqH/
  • exe.dropper

    http://139.99.89.211/wp-admin/VM1HRb3b0MGGdp/
  • exe.dropper

    http://onexone.elementor.cloud/cdrxhrt/632SFiWmT1Y/

Targets

    • Target
      tmp1hh5gocd
    • Size 134KB
    • SHA256 46736545f69d457a1b302df9a70ecd96aa8768650bb2bb31dbd1e312dc299def
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks