General
-
Target
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3.xls
-
Size
70KB
-
Sample
220303-sazt2sdcbr
-
MD5
74ef2589b372f105b31d69b352aec951
-
SHA1
2f12a5d662ee51bf73e7ddc2e04c7c018f367e36
-
SHA256
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3
-
SHA512
a5b2124f45034be6c2450a0623439fddf8251f431057ab004da9601f07f814ff6a5db6dbd74f09486ee5ed129a7c514effb999db0181161acaee856f529c7c4b
Behavioral task
behavioral1
Sample
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3.xls
Resource
win10-20220223-en
Behavioral task
behavioral2
Sample
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3.xls
Resource
win10-en-20211208
Malware Config
Extracted
http://185.7.214.7/fer/fe2.html
Targets
-
-
Target
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3.xls
-
Size
70KB
-
MD5
74ef2589b372f105b31d69b352aec951
-
SHA1
2f12a5d662ee51bf73e7ddc2e04c7c018f367e36
-
SHA256
561f1541d1ce60dd8a10c61c54f99d83e67ed86b0f645a6e564a99baa08f56b3
-
SHA512
a5b2124f45034be6c2450a0623439fddf8251f431057ab004da9601f07f814ff6a5db6dbd74f09486ee5ed129a7c514effb999db0181161acaee856f529c7c4b
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-