Overview

overview

10

Static

static

8

65c4cb8f28...18.doc

windows7-x64

10

65c4cb8f28...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65c4cb8f28072f54b974a779abf3f3b0_JaffaCakes118

  • Size

    164KB

  • Sample

    240522-dera5sab29

  • MD5

    65c4cb8f28072f54b974a779abf3f3b0

  • SHA1

    dfb0196e75ae7f9e989cfa7b57f742a3c10e455a

  • SHA256

    5184e08e6c595ddbb60b6ac4030286b2e70fa5ee7567cb0360b2a66ec04f8d89

  • SHA512

    9c40f9f848e481bf6bcb0ffe7cc69e427f7130bd5307f6905c5694f6480bc180ce855baf22fa0443c353b03bcba5c881ca4159afe93cc133557e5b62295d99d2

  • SSDEEP

    1536:MgjIgjhrdi1Ir77zOH98Wj2gpngx+a9abzN+oEyNC84/4IqJhe:lrfrzOH98ipg9oETMIqze

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://an9news.com/aokhf/XPXV7/
exe.dropper

https://www.17geci.com/vi2w6/Z5i/
exe.dropper

https://rubycityvietnam.com/wp-admin/1c0NVtp/
exe.dropper

https://lami-jo.com/wp-admin/VMeklEt/
exe.dropper

http://vayvontinchap5s.com/vayvon5s.com/YH3mx/
exe.dropper

http://jiamini.us-east-1.elasticbeanstalk.com/static/P1Vcv/
exe.dropper

http://wach8.com/cgi-bin/5JyZcRU/

Targets

    • Target

      65c4cb8f28072f54b974a779abf3f3b0_JaffaCakes118

    • Size

      164KB

    • MD5

      65c4cb8f28072f54b974a779abf3f3b0

    • SHA1

      dfb0196e75ae7f9e989cfa7b57f742a3c10e455a

    • SHA256

      5184e08e6c595ddbb60b6ac4030286b2e70fa5ee7567cb0360b2a66ec04f8d89

    • SHA512

      9c40f9f848e481bf6bcb0ffe7cc69e427f7130bd5307f6905c5694f6480bc180ce855baf22fa0443c353b03bcba5c881ca4159afe93cc133557e5b62295d99d2

    • SSDEEP

      1536:MgjIgjhrdi1Ir77zOH98Wj2gpngx+a9abzN+oEyNC84/4IqJhe:lrfrzOH98ipg9oETMIqze

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks