a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35 | Triage

Sharing

General

Target

a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35
Size

181KB
Sample

241120-2mlbvsvnaw
MD5

c87b8d603c1bbb68f7043b828d4f33d2
SHA1

9212853008d9740e1be2f2bc211160ac3a93d15f
SHA256

a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35
SHA512

8919fba1472d8b8cb175cab9b59414b4ba9b213bed93576cbedff9d73dabbc2703c597f3723b6a12991801be63765233bba7c3d032216206c48b78c5834dc7d3
SSDEEP

3072:6FOa2y/GdyDktGDWLS0HZWD5w8K7Nk9ND7IBUd5xKu/UW:COa2k43tGiL3HJk9ND7bdnKu/D

Score

10^/10

discovery execution macro

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://eilonstrategy.florencesoftwares.com/wp-content/mu/

exe.dropper

http://pakiskemenagntb.com/wp-content/4k/

exe.dropper

http://ivyfriend.com/ivypal/wp-includes/h20/

exe.dropper

http://julianaweb.cordeldigital.com/wp-includes/0vu/

exe.dropper

http://itsallinclusive.com/ar/Xd7OiT/

Targets

- Target
  
  a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35
- Size
  
  181KB
- MD5
  
  c87b8d603c1bbb68f7043b828d4f33d2
- SHA1
  
  9212853008d9740e1be2f2bc211160ac3a93d15f
- SHA256
  
  a0286161a13b0ac162da0033db923c453cb4073f50c3091a6fef75f344fc4e35
- SHA512
  
  8919fba1472d8b8cb175cab9b59414b4ba9b213bed93576cbedff9d73dabbc2703c597f3723b6a12991801be63765233bba7c3d032216206c48b78c5834dc7d3
- SSDEEP
  
  3072:6FOa2y/GdyDktGDWLS0HZWD5w8K7Nk9ND7IBUd5xKu/UW:COa2k43tGiL3HJk9ND7bdnKu/D
Score

10^/10

discovery execution
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2