General

  • Target
    FedEx Doc.js
  • Size 23.4MB
  • Sample260811-l2dmkacj2w
  • SHA256 e6281e5fa481b46cddcec262583b741e4414d29d08121a02c7e85e3a18403561
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      FedEx Doc.js
    • Size 23.4MB
    • SHA256 e6281e5fa481b46cddcec262583b741e4414d29d08121a02c7e85e3a18403561
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

MITRE ATT&CK Enterprise v16

Tasks