Overview

overview

10

Static

static

8

tmpy41x21as.xls

windows7_x64

10

tmpy41x21as.xls

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpy41x21as
  • Size 123KB
  • Sample220207-1g3taaaab2
  • SHA256 482575aa74c843151e0d2c4a80dff647a6bcee7bd74929f4df5ac81459c2766b
  • MD5 SHA1 SHA512
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://harperhouseproducts.com/Merchant2/ARsf1LIcOauhH1rDrIh/
  • exe.dropper

    http://holubvideo.com/eln-images/zqqgZ0YXaPiWbF/
  • exe.dropper

    http://magicblog.tatamotors.com/wp-includes/7faN9/
  • exe.dropper

    http://chastongroditski.com/eln-images/skSsCLJtI24kZvo/
  • exe.dropper

    http://seacupps.com/eln-images/AYvykzg/
  • exe.dropper

    http://ericandrobin.com/cgi/qRe8dRaG2HDNOOG1/
  • exe.dropper

    http://sosantiques.com/cgi/9ii/
  • exe.dropper

    https://greenlawnirrigation.net/GLI_New/JRlt3mOiezE/
  • exe.dropper

    https://on-lineventures.com/cgi/ks0Mp/
  • exe.dropper

    http://sunriseconsultant.com/eln-images/sO4XvFBsevCRf/

Targets

    • Target
      tmpy41x21as
    • Size 123KB
    • SHA256 482575aa74c843151e0d2c4a80dff647a6bcee7bd74929f4df5ac81459c2766b
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks