Overview

overview

10

Static

static

8

63d132996f...18.doc

windows7-x64

10

63d132996f...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63d132996f7a06ad3b1c8af4b3de92c7_JaffaCakes118

  • Size

    152KB

  • Sample

    240521-s3lg5aaf47

  • MD5

    63d132996f7a06ad3b1c8af4b3de92c7

  • SHA1

    d9b68068f1af79bfdc933ca2ae52129a67176788

  • SHA256

    bdc5631818335d59a977eee0b55578254df73a429b5c6a2d24b1956194e29c66

  • SHA512

    eddc3ea9fa62ef5c5a05f93aa4885c47aab738284bfd7f799863f011326ee939536f54475148af0e3d55bb178b12244becc18a259b3d79f61e3493d9d6b79103

  • SSDEEP

    1536:sgtIgPgtIgxrdi1Ir77zOH98Wj2gpngR+a9GrqYzE4gL3Pxzwn:irfrzOH98ipg8qYzE4Wxzwn

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.gozowindmill.com/meteo/97/
exe.dropper

http://www.greaudstudio.com/docs/Z/
exe.dropper

https://b176f.cn/wp-admin/1/
exe.dropper

https://blog.socialpill.in/jdzetd/fZuInax/
exe.dropper

http://maisshake.com.br/wp-includes/dPmzV1/
exe.dropper

http://mesdelicesitaliens.fr/wp-admin/tSlCBpP/
exe.dropper

http://grndl.com/oinj/j4/

Targets

    • Target

      63d132996f7a06ad3b1c8af4b3de92c7_JaffaCakes118

    • Size

      152KB

    • MD5

      63d132996f7a06ad3b1c8af4b3de92c7

    • SHA1

      d9b68068f1af79bfdc933ca2ae52129a67176788

    • SHA256

      bdc5631818335d59a977eee0b55578254df73a429b5c6a2d24b1956194e29c66

    • SHA512

      eddc3ea9fa62ef5c5a05f93aa4885c47aab738284bfd7f799863f011326ee939536f54475148af0e3d55bb178b12244becc18a259b3d79f61e3493d9d6b79103

    • SSDEEP

      1536:sgtIgPgtIgxrdi1Ir77zOH98Wj2gpngR+a9GrqYzE4gL3Pxzwn:irfrzOH98ipg8qYzE4Wxzwn

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks