Overview

overview

10

Static

static

8

f96bb6ad94...8.xlsb

windows7-x64

10

f96bb6ad94...8.xlsb

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f96bb6ad94a93f11b7ee2573ca12fc59_JaffaCakes118

  • Size

    108KB

  • Sample

    240419-d71qaaff75

  • MD5

    f96bb6ad94a93f11b7ee2573ca12fc59

  • SHA1

    e01514e7fc0bcc63740b54f63a2aeb3f75ed3e58

  • SHA256

    9bbc73e7a3ff9e02bb72e6f4f1cbdddc0a479f9d76e68118b54a89ce478ca1cd

  • SHA512

    2ed952289ef716bb8a6401c4778d31bb5a72f87e26e59111de93cc68db2c2f56b980882fe99380fa6137bd71432a298174f1f0de83d9729440a6a08b3d4980e9

  • SSDEEP

    3072:oUpuwTFU17LXELEi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3Pj:oS9TY7mF67MoaaaaaaaaaaaaaaaaaaaI

Score
10/10
macroxlm

Malware Config

Targets

    • Target

      f96bb6ad94a93f11b7ee2573ca12fc59_JaffaCakes118

    • Size

      108KB

    • MD5

      f96bb6ad94a93f11b7ee2573ca12fc59

    • SHA1

      e01514e7fc0bcc63740b54f63a2aeb3f75ed3e58

    • SHA256

      9bbc73e7a3ff9e02bb72e6f4f1cbdddc0a479f9d76e68118b54a89ce478ca1cd

    • SHA512

      2ed952289ef716bb8a6401c4778d31bb5a72f87e26e59111de93cc68db2c2f56b980882fe99380fa6137bd71432a298174f1f0de83d9729440a6a08b3d4980e9

    • SSDEEP

      3072:oUpuwTFU17LXELEi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3Pj:oS9TY7mF67MoaaaaaaaaaaaaaaaaaaaI

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks