Overview

overview

10

Static

static

8

tmpybwqqdja.xls

windows7_x64

10

tmpybwqqdja.xls

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpybwqqdja
  • Size 123KB
  • Sample220207-zzhemahebm
  • SHA256 4763d0761a6f623ec4a99030b64de1fb6db436fc7a3f74c04dfacc4fb8f570c2
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://harperhouseproducts.com/Merchant2/ARsf1LIcOauhH1rDrIh/
  • exe.dropper

    http://holubvideo.com/eln-images/zqqgZ0YXaPiWbF/
  • exe.dropper

    http://magicblog.tatamotors.com/wp-includes/7faN9/
  • exe.dropper

    http://chastongroditski.com/eln-images/skSsCLJtI24kZvo/
  • exe.dropper

    http://seacupps.com/eln-images/AYvykzg/
  • exe.dropper

    http://ericandrobin.com/cgi/qRe8dRaG2HDNOOG1/
  • exe.dropper

    http://sosantiques.com/cgi/9ii/
  • exe.dropper

    https://greenlawnirrigation.net/GLI_New/JRlt3mOiezE/
  • exe.dropper

    https://on-lineventures.com/cgi/ks0Mp/
  • exe.dropper

    http://sunriseconsultant.com/eln-images/sO4XvFBsevCRf/

Targets

    • Target
      tmpybwqqdja
    • Size 123KB
    • SHA256 4763d0761a6f623ec4a99030b64de1fb6db436fc7a3f74c04dfacc4fb8f570c2
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks