Overview

overview

10

Static

static

8

tmpnj0ssw93.xls

windows7_x64

10

tmpnj0ssw93.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpnj0ssw93
  • Size 129KB
  • Sample220207-3ll3faagbl
  • SHA256 07e5152cf70487d86e525670cf3199b2950e7665c8e680547e71dd5266efde03
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://fullness-safety.com/-/P6x/
  • exe.dropper

    https://nabajyotifoundation.com/da8uc7jo/4Za/
  • exe.dropper

    https://dwwmaster.com/wp-content/ebHTB4UF2/
  • exe.dropper

    http://formula8020.com/css/56Dzi0P/
  • exe.dropper

    https://calad-formation.fr/r3x94z/kgZ9OGCi/
  • exe.dropper

    http://lissbernardin.com/hthjb3i/x9KHpCeYrr/
  • exe.dropper

    http://royalsnackmyanmar.com/wp-includes/GMtz6DxM/
  • exe.dropper

    http://pristineservices.findfacts.co.in/cgi-bin/BuLyc2HKLHIQVHQLc/
  • exe.dropper

    http://speedrankingsystem.de/wp-admin/k63ZcimPsE6/
  • exe.dropper

    https://tigela.org.np/wp-content/Irp27O71/

Targets

    • Target
      tmpnj0ssw93
    • Size 129KB
    • SHA256 07e5152cf70487d86e525670cf3199b2950e7665c8e680547e71dd5266efde03
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks