Overview

overview

10

Static

static

8

ff0ebab531...15.doc

windows7_x64

10

ff0ebab531...15.doc

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff0ebab531232f9ae8d5b2ad78ace8848adffedec41de03b8676c956c14c6015

  • Size

    184KB

  • Sample

    220520-31nvkshha5

  • MD5

    18153b00c4bcc38b4722b6d8a6ba7d8f

  • SHA1

    12efef41170425598e89096a4069e0feee05bc96

  • SHA256

    ff0ebab531232f9ae8d5b2ad78ace8848adffedec41de03b8676c956c14c6015

  • SHA512

    32d4a1b7328a0d39dff9228dcaee00e617a040c767643458761107b682dc09fb3829b075ba0d13d4847babe9f556eaf2019acb9cfa31f5a38851abee1c0c124d

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://thestratumsphere.com/wp-admin/wODL/
exe.dropper

https://tmlsconsulting.com/abay/RI/
exe.dropper

https://is-yap.com/wp-admin/AA7/
exe.dropper

http://chendonghui.cn/wp-content/Z/
exe.dropper

http://veterinariapetlife.cl/4br/AXC5/
exe.dropper

http://blueseasports.com/iv/
exe.dropper

http://webdemo.cl/clmd/hVf/

Targets

    • Target

      ff0ebab531232f9ae8d5b2ad78ace8848adffedec41de03b8676c956c14c6015

    • Size

      184KB

    • MD5

      18153b00c4bcc38b4722b6d8a6ba7d8f

    • SHA1

      12efef41170425598e89096a4069e0feee05bc96

    • SHA256

      ff0ebab531232f9ae8d5b2ad78ace8848adffedec41de03b8676c956c14c6015

    • SHA512

      32d4a1b7328a0d39dff9228dcaee00e617a040c767643458761107b682dc09fb3829b075ba0d13d4847babe9f556eaf2019acb9cfa31f5a38851abee1c0c124d

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks