Overview

overview

10

Static

static

1

a3ad446626...92.xls

windows7-x64

10

a3ad446626...92.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3ad446626bebe8f644aecc09a0d37995db5519c579d3930ac045a5a45c05692.xls

  • Size

    165KB

  • Sample

    240818-bs7h6sxfnb

  • MD5

    2fee83fc2c5af9605530ce72a97a9c7b

  • SHA1

    dfeed802de1f062c3a3fdd36a529d86772db6005

  • SHA256

    a3ad446626bebe8f644aecc09a0d37995db5519c579d3930ac045a5a45c05692

  • SHA512

    2614fafe15ad2198fd3bb524d26b959b7c8de3becdf547dddaf2879d72e7c412beea2723b9882e6bf511d265483e14316596ef943133a59f47c97fa84424cd4a

  • SSDEEP

    3072:jUYpmZjeGXnuqKfMMVG+MhD1e5pzYJIjB0ssuyg6kB3f8:AY0Tif7G+MhE30Ojp0grBv8

Score
10/10
discoveryexecution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg
exe.dropper

https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg

Targets

    • Target

      a3ad446626bebe8f644aecc09a0d37995db5519c579d3930ac045a5a45c05692.xls

    • Size

      165KB

    • MD5

      2fee83fc2c5af9605530ce72a97a9c7b

    • SHA1

      dfeed802de1f062c3a3fdd36a529d86772db6005

    • SHA256

      a3ad446626bebe8f644aecc09a0d37995db5519c579d3930ac045a5a45c05692

    • SHA512

      2614fafe15ad2198fd3bb524d26b959b7c8de3becdf547dddaf2879d72e7c412beea2723b9882e6bf511d265483e14316596ef943133a59f47c97fa84424cd4a

    • SSDEEP

      3072:jUYpmZjeGXnuqKfMMVG+MhD1e5pzYJIjB0ssuyg6kB3f8:AY0Tif7G+MhE30Ojp0grBv8

    Score
    10/10
    discoveryexecution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Abuses OpenXML format to download file from external location

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks