Overview

overview

10

Static

static

8

2d2b0c7b43...18.doc

windows7-x64

10

2d2b0c7b43...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2d2b0c7b4325da2fa989ea8ac308697b_JaffaCakes118
  • Size 86KB
  • Sample240510-eal2ascb96
  • SHA256 1f33a3b176c7062a63b392a64c21e5c05bcd0c920a363bbcde4a1a0bc9ad2b8d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macromacro_on_action

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://alpharockgroup.com/HT
  • exe.dropper

    http://adminflex.dk/l5TF6w
  • exe.dropper

    http://gailong.net/X5AyWfJG
  • exe.dropper

    http://shunji.org/logsite/TJaaB
  • exe.dropper

    http://binar48.ru/OtTlVIU5

Targets

    • Target
      2d2b0c7b4325da2fa989ea8ac308697b_JaffaCakes118
    • Size 86KB
    • SHA256 1f33a3b176c7062a63b392a64c21e5c05bcd0c920a363bbcde4a1a0bc9ad2b8d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks