a656dee4269b3997b9c50dec27b01a0b528b4e9c380e999a4d6fc146a8a043ba | Triage

Sharing

General

Target

a656dee4269b3997b9c50dec27b01a0b528b4e9c380e999a4d6fc146a8a043ba
Size

43KB
Sample

241113-prqe6avphr
MD5

ba1df3c08761362acf60d3744435d002
SHA1

58c1d453c10552d9ed4168dcc45b74f28d6ae765
SHA256

a656dee4269b3997b9c50dec27b01a0b528b4e9c380e999a4d6fc146a8a043ba
SHA512

0d81189faa0060ec76820138ee8024b98e50fcf4c1daac0293468d36d98573e96b4efd4e93bb6618e82d8b0c01b7b12c68c68af49d85b82e3c19e685b3f15eda
SSDEEP

768:Cg9fz2npoNO6jTLmy6EIvvS5tTxk80Ggh4akRHWBlLWurRY7sh0nsYZgkmmGA0M:Cgx2npsOxfvveTk80GmkUlLdr4sYCkmg

Score

10^/10

discovery macro xlm

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://185.7.214.7/fer/fe2.html

Targets

- Target
  
  6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5
- Size
  
  71KB
- MD5
  
  21fc12ef8a4a4ba5b38a303fa7e70c08
- SHA1
  
  5700a2231371b289eae19ce62e1a73457ee582c4
- SHA256
  
  6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5
- SHA512
  
  8200f14c0a8023bb74b39796f7859258ef67a21a5f81704f82315695409795fe724ac8ca81513a95d50d169c824532e43865846ce42b0e541366309ace849654
- SSDEEP
  
  1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2