Overview

overview

10

Static

static

2511.doc

windows7_x64

10

2511.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2511.doc
  • Size 110KB
  • Sample211125-nav4msace3
  • SHA256 4054a4f314849369670235f1c40d35d15de7252d8d88d21fe66e5faabdcbf495
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://morishim.com/wp-content/EFhkVPdHVN/
  • exe.dropper

    https://gezweb.com/2021/y5vxVZg6WY62u1lFpR77q/
  • exe.dropper

    http://computerservicestoronto.com/Senaah/4sLAWGga/
  • exe.dropper

    https://test.ohmyhome.com/licenses/Xh2Jf3Pbx8CZa/
  • exe.dropper

    https://shop1.techraticsoftware.com/ALFA_DATA/alfacgiapi/jtFoay/
  • exe.dropper

    https://xj.91liebian.top/k8w4h6rd/Gt4BYqWBs4ZUGEM5oPr/
  • exe.dropper

    https://brandedmedia.io/Joey/BPQD5Bchj4BrH/

Targets

    • Target
      2511.doc
    • Size 110KB
    • SHA256 4054a4f314849369670235f1c40d35d15de7252d8d88d21fe66e5faabdcbf495
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks