Overview

overview

10

Static

static

8

0b2fb7583a...18.doc

windows7-x64

10

0b2fb7583a...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0b2fb7583ac2895bcc2a640d38a045a7_JaffaCakes118

  • Size

    165KB

  • Sample

    240501-gfvlqshd41

  • MD5

    0b2fb7583ac2895bcc2a640d38a045a7

  • SHA1

    bbc941c4efcc944c263c33594d7a816c7372a11e

  • SHA256

    1b96135a2846d7a48ebfda9e2ca65dd11d6820c9fb6f1ef9a9b2b15395cf48c9

  • SHA512

    66567cdd5baf13edfcce71c76af84f714e3d3be14e459fee49e5654f692aa4d0e44d7a153092662a0184e03d5fe29b65e048778e4943b66e295e96010b34ae5e

  • SSDEEP

    1536:MgjIgjhrdi1Ir77zOH98Wj2gpngx+a9qbzN+oEyNC84/4IqzhO:lrfrzOH98ipg9oETMIqNO

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://an9news.com/aokhf/XPXV7/
exe.dropper

https://www.17geci.com/vi2w6/Z5i/
exe.dropper

https://rubycityvietnam.com/wp-admin/1c0NVtp/
exe.dropper

https://lami-jo.com/wp-admin/VMeklEt/
exe.dropper

http://vayvontinchap5s.com/vayvon5s.com/YH3mx/
exe.dropper

http://jiamini.us-east-1.elasticbeanstalk.com/static/P1Vcv/
exe.dropper

http://wach8.com/cgi-bin/5JyZcRU/

Targets

    • Target

      0b2fb7583ac2895bcc2a640d38a045a7_JaffaCakes118

    • Size

      165KB

    • MD5

      0b2fb7583ac2895bcc2a640d38a045a7

    • SHA1

      bbc941c4efcc944c263c33594d7a816c7372a11e

    • SHA256

      1b96135a2846d7a48ebfda9e2ca65dd11d6820c9fb6f1ef9a9b2b15395cf48c9

    • SHA512

      66567cdd5baf13edfcce71c76af84f714e3d3be14e459fee49e5654f692aa4d0e44d7a153092662a0184e03d5fe29b65e048778e4943b66e295e96010b34ae5e

    • SSDEEP

      1536:MgjIgjhrdi1Ir77zOH98Wj2gpngx+a9qbzN+oEyNC84/4IqzhO:lrfrzOH98ipg9oETMIqNO

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks