General

  • Target

    46a491f2e1979c5b2ac43088db24095c449d27dabe1d2b7191f45f0ce37a19ca

  • Size

    571KB

  • Sample

    221126-ystnmsec5x

  • MD5

    2c18c7f3298c19e95e41eb3bf30df5ca

  • SHA1

    30def60a874f8491d8efe43be8422df818e151b2

  • SHA256

    46a491f2e1979c5b2ac43088db24095c449d27dabe1d2b7191f45f0ce37a19ca

  • SHA512

    9ffce3a1f04191136cb5bdef549b2797edec5e0a70864f3c655779760508337239b79a81f6f05bc9c7bdaac0db2d8b73ec7cdfcb8839c2a90c8670d6499f498a

  • SSDEEP

    12288:JfM00v7/byoLC80hnsoCA0pwXMfR466GqY/bpKXJEjz6bLHv0fwz3xWgEOGvfZGb:av7zyQNuPCA0pw8R46zz1jz6/v0fGWgZ

Score
10/10

Malware Config

Targets

    • Target

      高坝农贸市场附近楼房FTTH改造/高坝农贸市场附近楼房FTTH改造/高坝农贸市场附近楼房FTTH改造信息表.xls

    • Size

      214KB

    • MD5

      0dfe9e30eee8d65f46754dfaf9b0ab03

    • SHA1

      9a549d0d446f03f2e2bc2de8484efbf61d49089b

    • SHA256

      fb3351810c7b2f776cf8c7bc9a98836cc7fe89c6a1197e5c24bdad21b7eeb08e

    • SHA512

      b4476133a07531ef0c24b44b7c97284b0b6dc35b0e74106b098f29b20628a1666e00afdbf10713a3e843375405f90832673ca9ed90c8c0fdd47980f30695f70c

    • SSDEEP

      3072:rQUJBhwk97bur8yhwc9CpWVbrzQ7ITkIW1uDamLUV:EUCIU3V6

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks