Overview

overview

10

Static

static

8

f0694d38c8...fc.xls

windows7-x64

10

f0694d38c8...fc.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0694d38c88c19bf3f891b90cbed7588a0234895c93f819a88bf27e22550f2fc

  • Size

    24KB

  • Sample

    221128-tr9w1sca8v

  • MD5

    f584a24f2423784935912fec4c69cac3

  • SHA1

    6b441f8e8b387c0cf55f42a459bc1b6b475df097

  • SHA256

    f0694d38c88c19bf3f891b90cbed7588a0234895c93f819a88bf27e22550f2fc

  • SHA512

    9c9954a9537902119077f0278046b2dc5387f950bffc304d4c8c13189532b56b257ce6f89c9b7ddf5e123dc15c4b7c0a339d3e2d884dd8a3e7b7973be4cbab08

  • SSDEEP

    192:pBgqHa439gyLPUV+/T/D/199huyDycjCxGi+yE1fQ/yGCl7sXZBik9VWa9:po+LbthuQbCIia1fCz

Score
10/10
macromacro_on_action

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://92.63.88.87/sdeoefefs/dfssk.cab

Targets

    • Target

      f0694d38c88c19bf3f891b90cbed7588a0234895c93f819a88bf27e22550f2fc

    • Size

      24KB

    • MD5

      f584a24f2423784935912fec4c69cac3

    • SHA1

      6b441f8e8b387c0cf55f42a459bc1b6b475df097

    • SHA256

      f0694d38c88c19bf3f891b90cbed7588a0234895c93f819a88bf27e22550f2fc

    • SHA512

      9c9954a9537902119077f0278046b2dc5387f950bffc304d4c8c13189532b56b257ce6f89c9b7ddf5e123dc15c4b7c0a339d3e2d884dd8a3e7b7973be4cbab08

    • SSDEEP

      192:pBgqHa439gyLPUV+/T/D/199huyDycjCxGi+yE1fQ/yGCl7sXZBik9VWa9:po+LbthuQbCIia1fCz

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks