Overview

overview

10

Static

static

8

af0870e941...18.doc

windows7-x64

10

af0870e941...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    af0870e941a776d5efda87418f75870e_JaffaCakes118
  • Size 235KB
  • Sample240404-elx8pseb7s
  • SHA256 fcf9e5af91a1e9c9c86995546e2174bbe7125f9a027bcd06106bd8f383a8e414
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetbankermacromacro_on_actiontrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://www.optosvet.com/NZJFq7P/
  • exe.dropper

    http://janeensart.com/cMn6Qso1ny/
  • exe.dropper

    http://www.usugeotechno.com/OLDq8XAVG/
  • exe.dropper

    http://www.qpalconsultancy.com/wp-content/gZPTPm/
  • exe.dropper

    http://vent-postavka.com/0IPz87qOj/

Targets

    • Target
      af0870e941a776d5efda87418f75870e_JaffaCakes118
    • Size 235KB
    • SHA256 fcf9e5af91a1e9c9c86995546e2174bbe7125f9a027bcd06106bd8f383a8e414
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetbankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks