Overview

overview

10

Static

static

8

20467c5911...18.doc

windows7-x64

10

20467c5911...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    20467c5911953d273458c8204d56d9ca_JaffaCakes118

  • Size

    195KB

  • Sample

    240507-l6cwtsbf4z

  • MD5

    20467c5911953d273458c8204d56d9ca

  • SHA1

    2e1681d355f57f1d90089cb5858216c785e9796f

  • SHA256

    12c96f80fe4fb65075234dbad10058e7efbe9f07774d8ca20219f5b5fd0b7c00

  • SHA512

    c79fd8c816bc28046a190424d73edcecf5b575f298f992eadbc33af771f8fcddb733e57836a14d0efd269b566d6c80a10044a14b24106a721d425a69d098c5dc

  • SSDEEP

    1536:DGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xilqfqdFTaFVT/EA8s9p8cjMfmVSe:+rfrzOH98ipgFd58c/k

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://boys86.com/wp-admin/mO/
exe.dropper

http://dacyclin.com/3qx/Z/
exe.dropper

https://fepami.com/wp-includes/oRT/
exe.dropper

https://xnxxfullhd.com/wp-admin/NAK/
exe.dropper

https://www.business-management-degree.net/wp-snapshots/W/
exe.dropper

http://homestay.design/wordpress/M/
exe.dropper

https://csc-comunity.com/wp-admin/6DW/

Targets

    • Target

      20467c5911953d273458c8204d56d9ca_JaffaCakes118

    • Size

      195KB

    • MD5

      20467c5911953d273458c8204d56d9ca

    • SHA1

      2e1681d355f57f1d90089cb5858216c785e9796f

    • SHA256

      12c96f80fe4fb65075234dbad10058e7efbe9f07774d8ca20219f5b5fd0b7c00

    • SHA512

      c79fd8c816bc28046a190424d73edcecf5b575f298f992eadbc33af771f8fcddb733e57836a14d0efd269b566d6c80a10044a14b24106a721d425a69d098c5dc

    • SSDEEP

      1536:DGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xilqfqdFTaFVT/EA8s9p8cjMfmVSe:+rfrzOH98ipgFd58c/k

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks