Overview

overview

10

Static

static

8

114218cc0c...18.doc

windows7-x64

10

114218cc0c...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    114218cc0cda4bc9d777ad1554cb1392_JaffaCakes118
  • Size 152KB
  • Sample240504-c3c8rabb3x
  • SHA256 3965c5327e4e062d2a2786b689644741b4aaace1fa09ebda27313bd56e69ee6b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://treadball.com/viqrqs/92192/
  • exe.dropper

    http://bigplan-alex.com/APP.bigplan-alex.com/3ey6ryl636/
  • exe.dropper

    http://amzonfun.com/clricns/npq12319/
  • exe.dropper

    https://giaodienweb.xyz/fckeditor/sb22068/
  • exe.dropper

    https://www.gronowskiphotos.net/wp-includes/zuxd6z30145/

Targets

    • Target
      114218cc0cda4bc9d777ad1554cb1392_JaffaCakes118
    • Size 152KB
    • SHA256 3965c5327e4e062d2a2786b689644741b4aaace1fa09ebda27313bd56e69ee6b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks