Overview

overview

10

Static

static

8

tmpbh_wuxg1.xlsm

windows7_x64

10

tmpbh_wuxg1.xlsm

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpbh_wuxg1
  • Size 92KB
  • Sample220207-3j3bmsagd2
  • SHA256 13a893f17fa5b97e6c879ea8526633ae45691e09c23206aceeb2eba66c6b07bc
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://harperhouseproducts.com/Merchant2/ARsf1LIcOauhH1rDrIh/
  • exe.dropper

    http://holubvideo.com/eln-images/zqqgZ0YXaPiWbF/
  • exe.dropper

    http://magicblog.tatamotors.com/wp-includes/7faN9/
  • exe.dropper

    http://chastongroditski.com/eln-images/skSsCLJtI24kZvo/
  • exe.dropper

    http://seacupps.com/eln-images/AYvykzg/
  • exe.dropper

    http://ericandrobin.com/cgi/qRe8dRaG2HDNOOG1/
  • exe.dropper

    http://sosantiques.com/cgi/9ii/
  • exe.dropper

    https://greenlawnirrigation.net/GLI_New/JRlt3mOiezE/
  • exe.dropper

    https://on-lineventures.com/cgi/ks0Mp/
  • exe.dropper

    http://sunriseconsultant.com/eln-images/sO4XvFBsevCRf/

Targets

    • Target
      tmpbh_wuxg1
    • Size 92KB
    • SHA256 13a893f17fa5b97e6c879ea8526633ae45691e09c23206aceeb2eba66c6b07bc
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks