Overview

overview

10

Static

static

8

991a19fb00...58.pps

windows7-x64

1

991a19fb00...58.pps

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    991a19fb00cda372dd1ce4a42580dc40872da5c5bfbb34301615f3870ea3fb58

  • Size

    4.2MB

  • Sample

    230615-pxmlfsgh9s

  • MD5

    6e556f6d3f74a4d70b934a0b9a8e3f5f

  • SHA1

    4be8a759afbf0b52ab7c319e352a3b071203f9cd

  • SHA256

    991a19fb00cda372dd1ce4a42580dc40872da5c5bfbb34301615f3870ea3fb58

  • SHA512

    f10e7d80a9d0c7e6c9dde642ad2a348e8159fb6c713123b15846063f27855d8006b6cf450005799ea384f169d11747e130e8d72e410f1c7d170b20143f6752fe

  • SSDEEP

    12288:opY0x0g5kr93W6vWZPtU2eEkTv9aPVT1dI5CV8+Je1C14KPXme6q9ISBj:om0xN5aG6+ZPtYEkTN5U8WP14KPXuSB

Score
10/10
macro

Malware Config

Targets

    • Target

      991a19fb00cda372dd1ce4a42580dc40872da5c5bfbb34301615f3870ea3fb58

    • Size

      4.2MB

    • MD5

      6e556f6d3f74a4d70b934a0b9a8e3f5f

    • SHA1

      4be8a759afbf0b52ab7c319e352a3b071203f9cd

    • SHA256

      991a19fb00cda372dd1ce4a42580dc40872da5c5bfbb34301615f3870ea3fb58

    • SHA512

      f10e7d80a9d0c7e6c9dde642ad2a348e8159fb6c713123b15846063f27855d8006b6cf450005799ea384f169d11747e130e8d72e410f1c7d170b20143f6752fe

    • SSDEEP

      12288:opY0x0g5kr93W6vWZPtU2eEkTv9aPVT1dI5CV8+Je1C14KPXme6q9ISBj:om0xN5aG6+ZPtYEkTN5U8WP14KPXuSB

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks