Overview

overview

10

Static

static

8

tmpds5okjoy.xls

windows7_x64

10

tmpds5okjoy.xls

windows10-2004_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpds5okjoy
  • Size 151KB
  • Sample220204-t79aescee6
  • SHA256 29ea49a9a0bb3bf5e8834e475f65bb1f6fba2c010caf34d52d032fa4616bf459
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_actionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://store.uxdsummit.com/wp-admin/VfgBSQa7Z/
  • exe.dropper

    https://glowrentals.com/wp-admin/f1zeAKGTnS6I/
  • exe.dropper

    http://candisee.bminteractivegroup.com/1g94ngo/2n7lJoPuPDEanPcX/
  • exe.dropper

    http://bachilleratoporciclos.org/wp-content/zR/
  • exe.dropper

    http://formula8020.com/css/JCuR6OE404DgR/
  • exe.dropper

    http://lucasandbarbiehodges.net/wp-content/nbKbVJ8E55V2I/
  • exe.dropper

    https://www.monet.kiev.ua/css/KvkD194/
  • exe.dropper

    http://royalsnackmyanmar.com/wp-includes/Z4E3Vtp8k4Z/
  • exe.dropper

    https://theclubgym.in/wp-includes/jnTMKV3pHa9a/
  • exe.dropper

    https://ssf2.edelta.in/Themes/7hGzIAH5BYf9fFLK/

Targets

    • Target
      tmpds5okjoy
    • Size 151KB
    • SHA256 29ea49a9a0bb3bf5e8834e475f65bb1f6fba2c010caf34d52d032fa4616bf459
    • MD5 SHA1 SHA512
    Score
    10/10
    persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks