Overview

overview

10

Static

static

8

2dc58a614b...18.doc

windows7-x64

10

2dc58a614b...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2dc58a614bb48124132d567d4ba2e866_JaffaCakes118

  • Size

    176KB

  • Sample

    240510-g4vlmsff4t

  • MD5

    2dc58a614bb48124132d567d4ba2e866

  • SHA1

    ea4a7a922f7dcee97e2475249903b61ebc873882

  • SHA256

    d7f9f33aa1e41e5cf3ed675039323eedced58cb2e29f20b2fb2b6df79ab141d2

  • SHA512

    8b03ae228e28f803a4f1adb0720392a01bf53c117d72e6c1729156ce22476025e51d57d18fbaf2e230f5ad74fc9876ed60a5fc56f12d3a9481c148a670e3ac2a

  • SSDEEP

    1536:GkPkfrdi1Ir77zOH98Wj2gpng9+a9qGnut1ExbYCYWOFBfM0jKMQ2gF:grfrzOH98ipgDuiX10+MngF

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://santyago.org/wp-content/0mcYS6/
exe.dropper

http://dandyair.com/font-awesome/rOOAL/
exe.dropper

https://www.tekadbatam.com/wp-content/AUiw/
exe.dropper

http://kellymorganscience.com/wp-content/SCsWM/
exe.dropper

https://tewoerd.eu/img/DALSKE/
exe.dropper

http://mediainmedia.com/plugin_opencart2.3-master/Atye/
exe.dropper

http://nuwagi.com/old/XLGjc/

Targets

    • Target

      2dc58a614bb48124132d567d4ba2e866_JaffaCakes118

    • Size

      176KB

    • MD5

      2dc58a614bb48124132d567d4ba2e866

    • SHA1

      ea4a7a922f7dcee97e2475249903b61ebc873882

    • SHA256

      d7f9f33aa1e41e5cf3ed675039323eedced58cb2e29f20b2fb2b6df79ab141d2

    • SHA512

      8b03ae228e28f803a4f1adb0720392a01bf53c117d72e6c1729156ce22476025e51d57d18fbaf2e230f5ad74fc9876ed60a5fc56f12d3a9481c148a670e3ac2a

    • SSDEEP

      1536:GkPkfrdi1Ir77zOH98Wj2gpng9+a9qGnut1ExbYCYWOFBfM0jKMQ2gF:grfrzOH98ipgDuiX10+MngF

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks