Overview

overview

10

Static

static

8

afmcdrpp.doc

windows7_x64

10

afmcdrpp.doc

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afmcdrpp

  • Size

    175KB

  • Sample

    220411-dgeecsbbg6

  • MD5

    f8ab6670f00a035e68134a7fd4dcb264

  • SHA1

    0fd60d0c821d6aa014171a05b7678a21b05056fe

  • SHA256

    f794639d67379bfe9c95c945acab77981d8f44fc8d75e2566e09aaff420cb280

  • SHA512

    f4f48f82ec065a0e7aaa2ae57eceeaead5b5ad7ff49b73cbaf332bf5329888714a8819aa64a95aabdec6471596f299d2a2c20e4557425e4da722d99cdbe5e45c

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.greaudstudio.com/docs/olohz_suq_munasyr/
exe.dropper

http://www.gravelrecords.com/wp-admin/5h_jns_l3s6/
exe.dropper

http://gtsouth.com/drinkmenu/38vq_z8al_r5cujfy90n/
exe.dropper

http://groncrete.com/bower_components/cvbh8_f0_84rai/
exe.dropper

http://www.gunesoluk.com/eotps/heb_x_1ehlbx9/

Targets

    • Target

      afmcdrpp

    • Size

      175KB

    • MD5

      f8ab6670f00a035e68134a7fd4dcb264

    • SHA1

      0fd60d0c821d6aa014171a05b7678a21b05056fe

    • SHA256

      f794639d67379bfe9c95c945acab77981d8f44fc8d75e2566e09aaff420cb280

    • SHA512

      f4f48f82ec065a0e7aaa2ae57eceeaead5b5ad7ff49b73cbaf332bf5329888714a8819aa64a95aabdec6471596f299d2a2c20e4557425e4da722d99cdbe5e45c

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks