Overview

overview

10

Static

static

8

tmpoojl824a.xls

windows7_x64

10

tmpoojl824a.xls

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpoojl824a
  • Size 129KB
  • Sample220207-xys4magaa4
  • SHA256 2eaa0632f5635d9f12a7c0f508a8b11f877fccdf2ecb4ce05abf613985082e06
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://fullness-safety.com/-/P6x/
  • exe.dropper

    https://nabajyotifoundation.com/da8uc7jo/4Za/
  • exe.dropper

    https://dwwmaster.com/wp-content/ebHTB4UF2/
  • exe.dropper

    http://formula8020.com/css/56Dzi0P/
  • exe.dropper

    https://calad-formation.fr/r3x94z/kgZ9OGCi/
  • exe.dropper

    http://lissbernardin.com/hthjb3i/x9KHpCeYrr/
  • exe.dropper

    http://royalsnackmyanmar.com/wp-includes/GMtz6DxM/
  • exe.dropper

    http://pristineservices.findfacts.co.in/cgi-bin/BuLyc2HKLHIQVHQLc/
  • exe.dropper

    http://speedrankingsystem.de/wp-admin/k63ZcimPsE6/
  • exe.dropper

    https://tigela.org.np/wp-content/Irp27O71/

Targets

    • Target
      tmpoojl824a
    • Size 129KB
    • SHA256 2eaa0632f5635d9f12a7c0f508a8b11f877fccdf2ecb4ce05abf613985082e06
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks