Overview

overview

10

Static

static

8

2ed422fb4a...18.doc

windows7-x64

10

2ed422fb4a...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ed422fb4a023af73c40611052c5dedc_JaffaCakes118

  • Size

    167KB

  • Sample

    240510-nbzhfsbb2w

  • MD5

    2ed422fb4a023af73c40611052c5dedc

  • SHA1

    d16936fefffd9db05d009149b4ad31dacdbc7359

  • SHA256

    5728aa05ef3551aa19530c31280bb3ea3c1e3a5002a0d7ff73c0defedf6d5f13

  • SHA512

    298c3acbc0481a276dec0c7a6dbdc34e572b056658fc202a4361b5b1de81abecd704982603f0ebca426f63570ee5e054df872525005272764bba5ff89200e330

  • SSDEEP

    3072:ExjnB29gb8onvGflgQjDic88w065Zh69txcqYtl7vtWQAO:Exy6Qj7Hw065Z4x3Yb71W

Score
10/10
executionmacromacro_on_action

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://orangereel.co.uk/zr3F
exe.dropper

http://www.mwmummeryroofing.com/0vG
exe.dropper

http://hawkinscs.com/F
exe.dropper

http://damnfinegifts.co.uk/I9Rxpm2y
exe.dropper

http://cotala.com/68vt

Targets

    • Target

      2ed422fb4a023af73c40611052c5dedc_JaffaCakes118

    • Size

      167KB

    • MD5

      2ed422fb4a023af73c40611052c5dedc

    • SHA1

      d16936fefffd9db05d009149b4ad31dacdbc7359

    • SHA256

      5728aa05ef3551aa19530c31280bb3ea3c1e3a5002a0d7ff73c0defedf6d5f13

    • SHA512

      298c3acbc0481a276dec0c7a6dbdc34e572b056658fc202a4361b5b1de81abecd704982603f0ebca426f63570ee5e054df872525005272764bba5ff89200e330

    • SSDEEP

      3072:ExjnB29gb8onvGflgQjDic88w065Zh69txcqYtl7vtWQAO:Exy6Qj7Hw065Z4x3Yb71W

    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks