Overview

overview

10

Static

static

8

f44a4e2d5f...8.xlsb

windows7-x64

10

f44a4e2d5f...8.xlsb

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f44a4e2d5fe0ef1d7e24afc0ea452031_JaffaCakes118

  • Size

    352KB

  • Sample

    240416-zjezkacb78

  • MD5

    f44a4e2d5fe0ef1d7e24afc0ea452031

  • SHA1

    225d774ceebd6d2cc7cf2c8f07de51eca7338f38

  • SHA256

    6eb00c5fee11ba0e5f5237689915f837dfb76a790a544255df4d1533d08d5c01

  • SHA512

    82261670afd3dc6fb2b5bf26c57fde56263dc0c46989e9a91094d77ad847ea9d376ee17773af06ed3306b6c7f6bb13bff17a6561680baf487ab58a492d8b560f

  • SSDEEP

    6144:ogAL6Lsn1YNP2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNR:ZA2LsSNOL2OGY/TTy2jEIJc6FNu3uPmr

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      f44a4e2d5fe0ef1d7e24afc0ea452031_JaffaCakes118

    • Size

      352KB

    • MD5

      f44a4e2d5fe0ef1d7e24afc0ea452031

    • SHA1

      225d774ceebd6d2cc7cf2c8f07de51eca7338f38

    • SHA256

      6eb00c5fee11ba0e5f5237689915f837dfb76a790a544255df4d1533d08d5c01

    • SHA512

      82261670afd3dc6fb2b5bf26c57fde56263dc0c46989e9a91094d77ad847ea9d376ee17773af06ed3306b6c7f6bb13bff17a6561680baf487ab58a492d8b560f

    • SSDEEP

      6144:ogAL6Lsn1YNP2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNR:ZA2LsSNOL2OGY/TTy2jEIJc6FNu3uPmr

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks