Overview

overview

10

Static

static

8

UPS-35VB3NGM8FYB.doc

windows7-x64

10

UPS-35VB3NGM8FYB.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    16c8d38dc63d3de5d7b17e8762740fa5_JaffaCakes118
  • Size 84KB
  • Sample240505-j7dteacb2t
  • SHA256 e3d3f1b3728e884b3af4112a6711824e3b08aeb6bc9677c1209a9c0d58451043
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://holipath.com/wp-includes/5_Z/
  • exe.dropper

    http://malaysiaonline.tk/viseuf24jd/S_5f/
  • exe.dropper

    http://gin-lovers.shop/cgi-bin/T_I/
  • exe.dropper

    http://malalai.com.br/site/kX_z/
  • exe.dropper

    http://icloudbackup.com.br/wp/b_y/

Targets

    • Target
      UPS-35VB3NGM8FYB.js
    • Size 174KB
    • SHA256 7bf68152579d01ba99862b61a91689e3507d8ee94024c729dda3e40635e3d671
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks