General
-
Target
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
-
Size
174KB
-
Sample
220521-m7e81sdbg7
-
MD5
3f3435d39a58537f153db99e870b30f8
-
SHA1
dfb5f9bd4524abecb5851021f5c8c574bf8d3658
-
SHA256
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
-
SHA512
7aac4cb45cf7cb8771a10e587f81c1ba13a489573d8887c08db1271aa088f871ef62a0b4b6097a902663761bbb77fb17c193b6d03a2538786eccd5c613cd678f
Static task
static1
Behavioral task
behavioral1
Sample
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc
Resource
win10v2004-20220414-en
Malware Config
Extracted
http://gscrow.com/wp-content/z768/
http://museubispodorosario.com/wp-includes/6r21947/
http://theunstoppablesummit.com/wp-admin/w4bsb1t03/
http://nusantaradatacenter.com/wp-content/upgrade/g2/
http://blog.nakiol.net/wp-content/f38/
Targets
-
-
Target
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
-
Size
174KB
-
MD5
3f3435d39a58537f153db99e870b30f8
-
SHA1
dfb5f9bd4524abecb5851021f5c8c574bf8d3658
-
SHA256
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
-
SHA512
7aac4cb45cf7cb8771a10e587f81c1ba13a489573d8887c08db1271aa088f871ef62a0b4b6097a902663761bbb77fb17c193b6d03a2538786eccd5c613cd678f
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-