Overview

overview

10

Static

static

1

dfa326f34e...e.xlam

windows7-x64

10

dfa326f34e...e.xlam

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    dfa326f34e1cee79084e2b095c75b37ba6005a78fd63f9e96d3f6baa340aa4de.xlsx

  • Size

    632KB

  • Sample

    240802-cyzaes1apq

  • MD5

    fedda7e243aef236425384a981433e98

  • SHA1

    95b33d7f3636a4dcd1ffab18473ab1ee133130fa

  • SHA256

    dfa326f34e1cee79084e2b095c75b37ba6005a78fd63f9e96d3f6baa340aa4de

  • SHA512

    0f00936a852ccef6535fd020c3eca664025317a941e30c44a842cf431570cfbd1548b45ad83e9527aad308b7c88d4fa910b29aba1653f24470eb8b7f6358d2da

  • SSDEEP

    12288:7TXiFNfTMlXPPGZQdqY0Zp0I6IAjwX917OVWb8/CgU5SThVHY4nX+bPBxN34Kq2H:7jgTK/P3qbp0I6IAjsuqMd1Y4n0Lq2eE

Score
10/10
discoveryexecution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg
exe.dropper

https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg

Targets

    • Target

      dfa326f34e1cee79084e2b095c75b37ba6005a78fd63f9e96d3f6baa340aa4de.xlsx

    • Size

      632KB

    • MD5

      fedda7e243aef236425384a981433e98

    • SHA1

      95b33d7f3636a4dcd1ffab18473ab1ee133130fa

    • SHA256

      dfa326f34e1cee79084e2b095c75b37ba6005a78fd63f9e96d3f6baa340aa4de

    • SHA512

      0f00936a852ccef6535fd020c3eca664025317a941e30c44a842cf431570cfbd1548b45ad83e9527aad308b7c88d4fa910b29aba1653f24470eb8b7f6358d2da

    • SSDEEP

      12288:7TXiFNfTMlXPPGZQdqY0Zp0I6IAjwX917OVWb8/CgU5SThVHY4nX+bPBxN34Kq2H:7jgTK/P3qbp0I6IAjsuqMd1Y4n0Lq2eE

    Score
    10/10
    discoveryexecution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks