Overview

overview

10

Static

static

8

dicksoncou...om.xls

windows7_x64

10

dicksoncou...om.xls

windows10-2004_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    dicksoncountychamber.com.xls
  • Size 151KB
  • Sample220201-ycdx9aahem
  • SHA256 8ba2b2a299e1f63dd4ef61c3a37c600a7c812c6313da75ae77865d4da70b5d9d
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://moneyquote.ja.deals/assets/jcCwxvuSRpES7VhWxj/
  • exe.dropper

    https://vestaseguridad.com.ar/wp-content/7JD9gufnwG/
  • exe.dropper

    https://mail.reddeeducacionvirtual.com/wp-includes/BqJi1K/
  • exe.dropper

    http://veluxcounterapi.orbitalwaves.it/assets/WW9KfK84odoSl7/
  • exe.dropper

    http://mylibass.in/wp-content/SYERoa6um9/
  • exe.dropper

    https://www.edhacare.com/Fox-C404/XDEQNngeH6Dg/
  • exe.dropper

    http://openhouse.co.zw/admin/l0nzhQ/
  • exe.dropper

    http://ilifetrend.com/wp-admin/qC/
  • exe.dropper

    http://sedes.si/wordpress/UVpGY5pQBX5X7pMxHs/
  • exe.dropper

    https://farmandcity.co.zw/error/9pMLU0bJGCFBDN/

Targets

    • Target
      dicksoncountychamber.com.xls
    • Size 151KB
    • SHA256 8ba2b2a299e1f63dd4ef61c3a37c600a7c812c6313da75ae77865d4da70b5d9d
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks