Overview

overview

10

Static

static

8

tmpxpktuos8.xls

windows7_x64

10

tmpxpktuos8.xls

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpxpktuos8
  • Size 129KB
  • Sample220208-ak2saabagj
  • SHA256 14ec684c8a2e63fc85ba3093d50a498020cdfbfe544f938e90c8f12deb73c372
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://santafetortilla.com/_baks/tUx9/
  • exe.dropper

    http://donbaham.com/Home_files/YS0PAZPXcYeraes/
  • exe.dropper

    http://barnhart-studios.com/eln-images/Vghg1n/
  • exe.dropper

    http://blute.com/3Dtech/jLu8IAnnj3gK9Wc/
  • exe.dropper

    http://zenzebra.net/plath/9Q0DBlE/
  • exe.dropper

    http://rogerschultz.com/eln-images/u0vT/
  • exe.dropper

    http://realacorp.net/PhotoGallery/UwmRHceSGbaCeGF/
  • exe.dropper

    http://miniflam.com/eln-images/fSwbQjUMAfGxgdw/
  • exe.dropper

    http://marezdecor.com/MarezGallery/sEQxWTpMJ7A8rAtY0D/
  • exe.dropper

    http://hollywoodvisual.com/eln-images/HIWl5z/

Targets

    • Target
      tmpxpktuos8
    • Size 129KB
    • SHA256 14ec684c8a2e63fc85ba3093d50a498020cdfbfe544f938e90c8f12deb73c372
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks