Overview

overview

10

Static

static

8

tmpkx8r5x27.xls

windows7_x64

10

tmpkx8r5x27.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpkx8r5x27
  • Size 123KB
  • Sample220207-2at38saebl
  • SHA256 a4b1a3ac3d72dd610308e4567b22972e7cc07e1d121dfc3a0d4a9aec21d1b919
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://harperhouseproducts.com/Merchant2/ARsf1LIcOauhH1rDrIh/
  • exe.dropper

    http://holubvideo.com/eln-images/zqqgZ0YXaPiWbF/
  • exe.dropper

    http://magicblog.tatamotors.com/wp-includes/7faN9/
  • exe.dropper

    http://chastongroditski.com/eln-images/skSsCLJtI24kZvo/
  • exe.dropper

    http://seacupps.com/eln-images/AYvykzg/
  • exe.dropper

    http://ericandrobin.com/cgi/qRe8dRaG2HDNOOG1/
  • exe.dropper

    http://sosantiques.com/cgi/9ii/
  • exe.dropper

    https://greenlawnirrigation.net/GLI_New/JRlt3mOiezE/
  • exe.dropper

    https://on-lineventures.com/cgi/ks0Mp/
  • exe.dropper

    http://sunriseconsultant.com/eln-images/sO4XvFBsevCRf/

Targets

    • Target
      tmpkx8r5x27
    • Size 123KB
    • SHA256 a4b1a3ac3d72dd610308e4567b22972e7cc07e1d121dfc3a0d4a9aec21d1b919
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks