Overview

overview

10

Static

static

8

01e2e34895...18.doc

windows7-x64

10

01e2e34895...18.doc

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01e2e3489568c9d07216b351faff5bdc_JaffaCakes118

  • Size

    33KB

  • Sample

    240426-29kzlsfa2s

  • MD5

    01e2e3489568c9d07216b351faff5bdc

  • SHA1

    6e6407b0843d176b3133243ed564032e87bddde8

  • SHA256

    f1cce2e826b3c2e6d7f0d03cfd2bd01faf925df8116e9d873bbc3cf62dc5c18c

  • SHA512

    b368e5d03cd6009b6b7da793bcd08cfd230a028b260c3c1600bd1b384ad968f53e614a6f9e739abb8d930d93fcf2172c9ec824e86efb33a911c783274f952281

  • SSDEEP

    192:9HTxlQZEvAIA6/6rrILd/Kf3HO8tnAP2EZUy0jWsLrtXGPqsoc78hBechH5ew2Ca:9rkiSUR/8dnr7y0jWertTsb7CB

Score
10/10
macromacro_on_action

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://poc.howielab.com/C2/Agent/20180504030337

Targets

    • Target

      01e2e3489568c9d07216b351faff5bdc_JaffaCakes118

    • Size

      33KB

    • MD5

      01e2e3489568c9d07216b351faff5bdc

    • SHA1

      6e6407b0843d176b3133243ed564032e87bddde8

    • SHA256

      f1cce2e826b3c2e6d7f0d03cfd2bd01faf925df8116e9d873bbc3cf62dc5c18c

    • SHA512

      b368e5d03cd6009b6b7da793bcd08cfd230a028b260c3c1600bd1b384ad968f53e614a6f9e739abb8d930d93fcf2172c9ec824e86efb33a911c783274f952281

    • SSDEEP

      192:9HTxlQZEvAIA6/6rrILd/Kf3HO8tnAP2EZUy0jWsLrtXGPqsoc78hBechH5ew2Ca:9rkiSUR/8dnr7y0jWertTsb7CB

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks