Overview

overview

10

Static

static

8

621f61036b...18.doc

windows7-x64

10

621f61036b...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    621f61036b3455c2f208244d427a0a1aJaffaCakes118

  • Size

    259KB

  • Sample

    240523-asr8taeg4s

  • MD5

    621f61036b3455c2f208244d427a0a1a

  • SHA1

    97a90cfcc9f8d1a268ae29c0fac7247798f68558

  • SHA256

    e48d84f3821901ac175931583751b6dc89592aaf1ea9896d95adb131652bedcc

  • SHA512

    27bd362a6938380823efd3c5608fe4d7be553fc363b7a367a428a0c96ec65c050c488cb419ee3d3a17429004be52b0eefdad5c306f3e8a683dbd8f50267c0c2b

  • SSDEEP

    3072:8H9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5nyXJm9YBmjDM2lNdsiGCT:8FVeEsjdXRC3jexGG6MYWof5dsiGCT

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.gurutransfer.com/cGQPt/
exe.dropper

http://www.prava-traktorista.ru/Pny/
exe.dropper

http://www.noobingame.tk/rP2E/
exe.dropper

http://www.frigolutasima.net/m/
exe.dropper

http://www.batikcar.com/GDW/

Targets

    • Target

      621f61036b3455c2f208244d427a0a1aJaffaCakes118

    • Size

      259KB

    • MD5

      621f61036b3455c2f208244d427a0a1a

    • SHA1

      97a90cfcc9f8d1a268ae29c0fac7247798f68558

    • SHA256

      e48d84f3821901ac175931583751b6dc89592aaf1ea9896d95adb131652bedcc

    • SHA512

      27bd362a6938380823efd3c5608fe4d7be553fc363b7a367a428a0c96ec65c050c488cb419ee3d3a17429004be52b0eefdad5c306f3e8a683dbd8f50267c0c2b

    • SSDEEP

      3072:8H9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5nyXJm9YBmjDM2lNdsiGCT:8FVeEsjdXRC3jexGG6MYWof5dsiGCT

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks