General

  • Target

    53711adeb3fec80af8471a1413eb267fd1ad143a08bb0fc9ad2f0fefa31919cd

  • Size

    88KB

  • Sample

    241113-zv5pcssmck

  • MD5

    62069e29ef1f2d3f87a647e5d1373d1b

  • SHA1

    3bd20dee31c41727bfce67d068895c8951499062

  • SHA256

    53711adeb3fec80af8471a1413eb267fd1ad143a08bb0fc9ad2f0fefa31919cd

  • SHA512

    106188d5c5122b1079d5297c8374275369f05147bca746c8be2e2dea38b53a99b3b08b99af54b6d05963cf1cde19a8af50f5511a67edbe03cde87aa069aac62c

  • SSDEEP

    1536:Ayehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQSCkWvgrPE4nWHPNc2AB:Ayehv7q2Pjx45uoDGTj+5xtekEvi8/dw

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/

exe.dropper

https://1566xueshe.com/wp-includes/z92ZVqHH8/

exe.dropper

http://mymicrogreen.mightcode.com/Fox-C/NWssAbNOJDxhs/

exe.dropper

http://o2omart.co.in/infructuose/m4mgt2MeU/

exe.dropper

http://mtc.joburg.org.za/-/GBGJeFxXWlNbABv2/

exe.dropper

http://www.ama.cu/jpr/VVP/

exe.dropper

http://actividades.laforetlanguages.com/wp-admin/dU8Ds/

exe.dropper

https://dwwmaster.com/wp-content/1sR2HfFxQnkWuu/

exe.dropper

https://edu-media.cn/wp-admin/0JAE/

exe.dropper

https://iacademygroup.cl/office/G42LJPLkl/

exe.dropper

https://znzhou.top/mode/0Qb/

Targets

    • Target

      53711adeb3fec80af8471a1413eb267fd1ad143a08bb0fc9ad2f0fefa31919cd

    • Size

      88KB

    • MD5

      62069e29ef1f2d3f87a647e5d1373d1b

    • SHA1

      3bd20dee31c41727bfce67d068895c8951499062

    • SHA256

      53711adeb3fec80af8471a1413eb267fd1ad143a08bb0fc9ad2f0fefa31919cd

    • SHA512

      106188d5c5122b1079d5297c8374275369f05147bca746c8be2e2dea38b53a99b3b08b99af54b6d05963cf1cde19a8af50f5511a67edbe03cde87aa069aac62c

    • SSDEEP

      1536:Ayehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQSCkWvgrPE4nWHPNc2AB:Ayehv7q2Pjx45uoDGTj+5xtekEvi8/dw

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

MITRE ATT&CK Enterprise v15

Tasks