General
-
Target
e3dd5f6eed7e4aa90ed1dcf1ed2c88baa464572a7244e758f2b2340c77e7bc9b
-
Size
99KB
-
Sample
220521-m7g3lsdbg8
-
MD5
301ed748041d7ce7a78f89b91de23c94
-
SHA1
8d5ab40d1c45576608cddb899a5d54b93c5c492c
-
SHA256
e3dd5f6eed7e4aa90ed1dcf1ed2c88baa464572a7244e758f2b2340c77e7bc9b
-
SHA512
757e4a2ad757059775f2084e452c345ec3e1c3450f758f3cd88dcd6e1960dab84343fdf89360852434688aec241d4a353664ccf308dba0ae141271eb88da88df
Static task
static1
Behavioral task
behavioral1
Sample
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc
Resource
win10v2004-20220414-en
Malware Config
Extracted
http://gscrow.com/wp-content/z768/
http://museubispodorosario.com/wp-includes/6r21947/
http://theunstoppablesummit.com/wp-admin/w4bsb1t03/
http://nusantaradatacenter.com/wp-content/upgrade/g2/
http://blog.nakiol.net/wp-content/f38/
Targets
-
-
Target
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
-
Size
174KB
-
MD5
3f3435d39a58537f153db99e870b30f8
-
SHA1
dfb5f9bd4524abecb5851021f5c8c574bf8d3658
-
SHA256
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
-
SHA512
7aac4cb45cf7cb8771a10e587f81c1ba13a489573d8887c08db1271aa088f871ef62a0b4b6097a902663761bbb77fb17c193b6d03a2538786eccd5c613cd678f
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-