General

  • Target
    http://www.facebook.com/tr/?id=2213273642818569&ev=PageView&dl=https://server.think-cell.com/portal/es/academics.srf?type=student&rl=https://www.think-cell.com/&if=false&ts=1783375365954&iw=false&sw=1280&sh=720&v=2.9.349&r=stable&a=tmSimo-GTM-WebTemplate-2.0.8-fcg&ec=0&o=12318&aems=0;0&fbp=fb.1.1783375344921.239060218538283001.AQYAAQIB&ler=other&cdl=API_unavailable&pmd[title]=Programa%20acad%C3%A9mico%20|%20think-cell&pmd[locale]=es&pmd[description]=%C3%9Anase%20a%20nuestro%20programa%20acad%C3%A9mico%20y%20utilice%20think-cell%20gratis.&plt=1488.0999999940395&iss=1&imft=1&tz=-240&it=1783375365428&coo=false&tm=1&expv20=pl0&expv21=el3&expv22=bc1&expv23=ra2&expv24=rp2&expv25=im1&expv26=hf1&rqm=GET
  • Sample260707-avhr6aev5t

Malware Config

Targets

    • Target
      http://www.facebook.com/tr/?id=2213273642818569&ev=PageView&dl=https://server.think-cell.com/portal/es/academics.srf?type=student&rl=https://www.think-cell.com/&if=false&ts=1783375365954&iw=false&sw=1280&sh=720&v=2.9.349&r=stable&a=tmSimo-GTM-WebTemplate-2.0.8-fcg&ec=0&o=12318&aems=0;0&fbp=fb.1.1783375344921.239060218538283001.AQYAAQIB&ler=other&cdl=API_unavailable&pmd[title]=Programa%20acad%C3%A9mico%20|%20think-cell&pmd[locale]=es&pmd[description]=%C3%9Anase%20a%20nuestro%20programa%20acad%C3%A9mico%20y%20utilice%20think-cell%20gratis.&plt=1488.0999999940395&iss=1&imft=1&tz=-240&it=1783375365428&coo=false&tm=1&expv20=pl0&expv21=el3&expv22=bc1&expv23=ra2&expv24=rp2&expv25=im1&expv26=hf1&rqm=GET
    • Drops desktop.ini file(s)

    • Detected potential entity reuse from brand GOOGLE.

MITRE ATT&CK Enterprise v16

Tasks