Overview

overview

10

Static

static

8

sample.doc

windows7-x64

10

sample.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0dd5a99dad581a214c3004371119a226_JaffaCakes118

  • Size

    61KB

  • Sample

    240502-hyajysbh9x

  • MD5

    0dd5a99dad581a214c3004371119a226

  • SHA1

    5c26fb9525db520b19c81f564687003fdd996361

  • SHA256

    0e502d11a2a9671e7fe539a5f02fcf0a70cd18231dc20286f66699f865e8244c

  • SHA512

    75d6f538f30db83baecefd9c74cd7c4ef6407c11e7ab65ac753c2441c311e5d97a7848bcae0c4e7aa5653fa71ab755efe7376251ae18f133f8ff029e13035783

  • SSDEEP

    1536:1P8h47EAVJEiw1TNDEPE7WMTxdLjfPz+MkpriNn40sV3I3PIjfNKb4N:ymgAVSxNl7WIxlj3z+MeiJ4xTjfEo

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://case.gonukkad.com/sys-cache/CjT/
exe.dropper

https://starrcoin.net/wp-admin/YT/
exe.dropper

http://modelaw.devkind.com.au/wp-admin/cvDRmGK/
exe.dropper

http://dprkp.palembang.go.id/sys-cache/7Y4aHw/
exe.dropper

http://completeguideblogging.com/euiot/PAuJG/
exe.dropper

http://qutiche.cn/wp-admin/Q/
exe.dropper

https://shiva-engineering.com/1cj/tKemHV7/

Targets

    • Target

      sample

    • Size

      158KB

    • MD5

      fc6278b0d199e93b832ae9720e40cf77

    • SHA1

      116aa48b76d2742ab9c08530ff443e19c5982164

    • SHA256

      84a3218db211f14f6afaf90ced3a518193158b80bbbf43bbf82a955d6064fa2d

    • SHA512

      949465890f0fa78b302f6291dba5aefa9a73bc8c6105864858a4167ee954d3334a1a2cbec7afd1589466cbb04aa6a0f8014bcbaf7c6024440f7f441287325058

    • SSDEEP

      1536:A2Fj72Fjmrdi1Ir77zOH98Wj2gpngh+a9WlJiEP:1rfrzOH98ipgMYEP

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks