Overview

overview

10

Static

static

8

11edb16a28...18.doc

windows7-x64

10

11edb16a28...18.doc

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    11edb16a28367f8bc85b85f637fb1a94_JaffaCakes118
  • Size 135KB
  • Sample240504-kjrk2agg7y
  • SHA256 2b6225d16f07d33fb329056ef0d2085db72abb53afca2dd8e5227580fecd6898
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://webbsmail.co.uk/zPZAdQ5B
  • exe.dropper

    http://vernonins.com/vpdpLgH9
  • exe.dropper

    http://usgmsp.com/sVy
  • exe.dropper

    http://videomercenary.com/F
  • exe.dropper

    http://vipersgarden.at/phpMyBackupPro/export/8

Targets

    • Target
      11edb16a28367f8bc85b85f637fb1a94_JaffaCakes118
    • Size 135KB
    • SHA256 2b6225d16f07d33fb329056ef0d2085db72abb53afca2dd8e5227580fecd6898
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks