Overview

overview

10

Static

static

8

50ea96b7c4...18.doc

windows7-x64

10

50ea96b7c4...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    50ea96b7c42b908b2821fa832e798db0_JaffaCakes118

  • Size

    220KB

  • Sample

    240517-xbtrmsda3w

  • MD5

    50ea96b7c42b908b2821fa832e798db0

  • SHA1

    c71acc8715ae12492ab48ff57df6bb998f11f5d7

  • SHA256

    75bf970f98cfafd5b377938aa46073f7818011dfa98561c7592703fe34dd1c92

  • SHA512

    fedd43457cadc7f9950b92e7c66e3e4176ec130c41f09a95e00e7d05ba87d62fe974ab7363ce70a7b17901c12552af98fc8079659141d0f5ee998d33b930653e

  • SSDEEP

    3072:b4tcTvjvTY140818tIP4ovpLSGju9jDW1M+7up3W:EtcnvE140o8tIP4ap8jDjmcW

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://hottco.com/stats/erd/
exe.dropper

http://dutarini.com/cgi-bin/6/
exe.dropper

https://brownshotelgroup.com/www.brownshotelgroup.com.pt/i9/
exe.dropper

http://pastaciyiz.biz/wp-includes/fvx/
exe.dropper

https://dogaltrm.com/components/r6h/
exe.dropper

https://dortislem.net/administrator/c/
exe.dropper

https://onyourleftracing.com/cgi-bin/QcC/

Targets

    • Target

      50ea96b7c42b908b2821fa832e798db0_JaffaCakes118

    • Size

      220KB

    • MD5

      50ea96b7c42b908b2821fa832e798db0

    • SHA1

      c71acc8715ae12492ab48ff57df6bb998f11f5d7

    • SHA256

      75bf970f98cfafd5b377938aa46073f7818011dfa98561c7592703fe34dd1c92

    • SHA512

      fedd43457cadc7f9950b92e7c66e3e4176ec130c41f09a95e00e7d05ba87d62fe974ab7363ce70a7b17901c12552af98fc8079659141d0f5ee998d33b930653e

    • SSDEEP

      3072:b4tcTvjvTY140818tIP4ovpLSGju9jDW1M+7up3W:EtcnvE140o8tIP4ap8jDjmcW

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks