General

  • Target

    4b969e0e8bacd113380394b18185717705faa47f3b6b6fcf3f989392f72b5328

  • Size

    36KB

  • Sample

    241120-ttw3yatpak

  • MD5

    51e8d88d8a478776909eb8b9e359cabd

  • SHA1

    25b38dad91febf7b36d48aa03db2486394240cdf

  • SHA256

    4b969e0e8bacd113380394b18185717705faa47f3b6b6fcf3f989392f72b5328

  • SHA512

    2751b8b9d77fce6f3c12809dbe0a728fe53bf9bd3cd83eb5f1111440ce3a0daa0a69a6142212384bf48c7603c5c91e4c17e4e8a5eb97a79f071f838f2913d747

  • SSDEEP

    768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://91.240.118.168/oo/aa/se.html

Targets

    • Target

      4b969e0e8bacd113380394b18185717705faa47f3b6b6fcf3f989392f72b5328

    • Size

      36KB

    • MD5

      51e8d88d8a478776909eb8b9e359cabd

    • SHA1

      25b38dad91febf7b36d48aa03db2486394240cdf

    • SHA256

      4b969e0e8bacd113380394b18185717705faa47f3b6b6fcf3f989392f72b5328

    • SHA512

      2751b8b9d77fce6f3c12809dbe0a728fe53bf9bd3cd83eb5f1111440ce3a0daa0a69a6142212384bf48c7603c5c91e4c17e4e8a5eb97a79f071f838f2913d747

    • SSDEEP

      768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks