Overview

overview

10

Static

static

8

2022-2-2-f...16.xls

windows7_x64

10

2022-2-2-f...16.xls

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    2022-2-2-fd4c23f8111e353bc9193f2c42c9ce16.bin
  • Size 151KB
  • Sample220201-3y4g9adea8
  • SHA256 50647a52f44702ef7b1cf07f13eb448cbf42517b4022b7314d73fd2a7de6d954
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://moneyquote.ja.deals/assets/jcCwxvuSRpES7VhWxj/
  • exe.dropper

    https://vestaseguridad.com.ar/wp-content/7JD9gufnwG/
  • exe.dropper

    https://mail.reddeeducacionvirtual.com/wp-includes/BqJi1K/
  • exe.dropper

    http://veluxcounterapi.orbitalwaves.it/assets/WW9KfK84odoSl7/
  • exe.dropper

    http://mylibass.in/wp-content/SYERoa6um9/
  • exe.dropper

    https://www.edhacare.com/Fox-C404/XDEQNngeH6Dg/
  • exe.dropper

    http://openhouse.co.zw/admin/l0nzhQ/
  • exe.dropper

    http://ilifetrend.com/wp-admin/qC/
  • exe.dropper

    http://sedes.si/wordpress/UVpGY5pQBX5X7pMxHs/
  • exe.dropper

    https://farmandcity.co.zw/error/9pMLU0bJGCFBDN/

Targets

    • Target
      2022-2-2-fd4c23f8111e353bc9193f2c42c9ce16.bin
    • Size 151KB
    • SHA256 50647a52f44702ef7b1cf07f13eb448cbf42517b4022b7314d73fd2a7de6d954
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks