Overview

overview

10

Static

static

8

7197d4c3cc...60.xls

windows7-x64

10

7197d4c3cc...60.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7197d4c3cc06e108e46f23b3d8f65860

  • Size

    438KB

  • Sample

    230125-j2avkafd26

  • MD5

    7197d4c3cc06e108e46f23b3d8f65860

  • SHA1

    453c4aa360fc4e7b6a419aeee5665ad430206bfc

  • SHA256

    c706d181f212db7b77462f871106ec1b9c255e68f88ff82b06499995af22d8bb

  • SHA512

    8b74f1b77684db45e0b9e7311798c9b84251fb09a77cd370d7adbc214d11e1fdaa05e5703dfbe8292537f0679e3fc5d1ce8bb013330c6a7aecbdee4636b870bb

  • SSDEEP

    12288:n947a/JjsLZjXYc7X0/aXCKli04OaZ1XAYThF0:zurYc7E/i004OS1ThF0

Score
10/10
macromacro_on_action

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://wildmanwildfood.com/wp-admin/wxyadXKXFe/
exe.dropper

https://ashven.co.uk/wp-includes/UwBairqGXVb11tCu/
exe.dropper

https://aigenix.comartstudios.com/cgi-bin/ZZ8HCNr40H/
exe.dropper

https://fastonlineearn.com/wp-content/L/
exe.dropper

https://mbmscaffolding.co.uk/test/3j/
exe.dropper

https://ineslebuhan.com/wp-includes/7dLR8UB3RFfSHd4cZN/
exe.dropper

https://mccoygloballinks.com/cgi-bin/HvZWLrLljiRj2ck/
exe.dropper

http://lonaomer.com/wp-content/6G/
exe.dropper

https://tainformado.com.br/wp-content/0Ysot/
exe.dropper

https://nifdtb.in/wp-content/9uHo3GBgyIQ/
exe.dropper

https://sdn3sajen.stormapp.in/wp-admin/Xc6Z/
exe.dropper

https://narsanat.com/banner/TnIhz/
exe.dropper

https://vanessanascimento.com.br/auren-xbox/cDD2dfW/
exe.dropper

https://medvital.com.br/arquivos/q6ZjbPPoR7l/
exe.dropper

https://mcjalandhar.in/1950-kill/BMoLHJM4g/
exe.dropper

https://nuranabd.com/wp-content/BhYOZ2pJV5q/
exe.dropper

https://sdigitaltv.online/wp-admin/rpRCArrXjpoUXo/
exe.dropper

http://news.leta.com.vn/-/NQOY80o/

Targets

    • Target

      7197d4c3cc06e108e46f23b3d8f65860

    • Size

      438KB

    • MD5

      7197d4c3cc06e108e46f23b3d8f65860

    • SHA1

      453c4aa360fc4e7b6a419aeee5665ad430206bfc

    • SHA256

      c706d181f212db7b77462f871106ec1b9c255e68f88ff82b06499995af22d8bb

    • SHA512

      8b74f1b77684db45e0b9e7311798c9b84251fb09a77cd370d7adbc214d11e1fdaa05e5703dfbe8292537f0679e3fc5d1ce8bb013330c6a7aecbdee4636b870bb

    • SSDEEP

      12288:n947a/JjsLZjXYc7X0/aXCKli04OaZ1XAYThF0:zurYc7E/i004OS1ThF0

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks