Overview

overview

10

Static

static

1

1e35156777...18.doc

windows7-x64

10

1e35156777...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e35156777f498663f05a328abcfba80_JaffaCakes118

  • Size

    123KB

  • Sample

    240506-y4wmdace74

  • MD5

    1e35156777f498663f05a328abcfba80

  • SHA1

    392937c8a098fcdca9d9cae58a5a05ec657f485f

  • SHA256

    9de70af07f1659f32c9e7aeb00a61ba1b1ca8e7985f1d5a3cc4197f67e8675b6

  • SHA512

    d259c69c274a7be8d768b426713336330b62bf94b836abcf38d4a5eeea24283242610b36ae7e488234482c73f2a76e6b98ea04603b2a13c68ef12c1b8acba0ef

  • SSDEEP

    3072:S77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q/tr0mTOl:S77HUUUUUUUUUUUUUUUUUUUT52V8r0m6

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://atlanticsg.com/wp-includes/fsfrz22_mkp29qlby-69478/
exe.dropper

http://eastpennlandscape.com/css/qhJUtdBFvM/
exe.dropper

http://mcs-interiors.co.uk/cgi-bin/MUbadZUIXD/
exe.dropper

http://laderajabugo.navicu.com/wp-admin/6ohv5j_6m40d-4652183/
exe.dropper

http://banphongresort.com/wp-includes/8hxbg02o_wkpvf-27459009/

Targets

    • Target

      1e35156777f498663f05a328abcfba80_JaffaCakes118

    • Size

      123KB

    • MD5

      1e35156777f498663f05a328abcfba80

    • SHA1

      392937c8a098fcdca9d9cae58a5a05ec657f485f

    • SHA256

      9de70af07f1659f32c9e7aeb00a61ba1b1ca8e7985f1d5a3cc4197f67e8675b6

    • SHA512

      d259c69c274a7be8d768b426713336330b62bf94b836abcf38d4a5eeea24283242610b36ae7e488234482c73f2a76e6b98ea04603b2a13c68ef12c1b8acba0ef

    • SSDEEP

      3072:S77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q/tr0mTOl:S77HUUUUUUUUUUUUUUUUUUUT52V8r0m6

    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks