Overview

overview

10

Static

static

8

3036836098...19.doc

windows7-x64

10

3036836098...19.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    138e0d31fbe24fca394ac4f758e86e8d_JaffaCakes118
  • Size 88KB
  • Sample240504-ty4nkseb68
  • SHA256 909d7529519c5a8d69b708d5c1aedc874554f88eee986ed22fe3540f581ff5fe
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://webaphobia.com/images/72Ca/
  • exe.dropper

    https://montalegrense.graficosassociados.com/keywords/FOYo/
  • exe.dropper

    http://purimaro.com/1/ww/
  • exe.dropper

    http://jpmtech.com/css/GOOvqd/
  • exe.dropper

    http://118.89.215.166/wp-includes/l5/

Targets

    • Target
      303683609857-May_01_2019.doc
    • Size 150KB
    • SHA256 6c53c3f9f2d4a2371367019734bed40ff98401090a297b4856b9997df56168ff
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks