Overview

overview

10

Static

static

8

UPS-X7013FXI85.doc

windows7-x64

10

UPS-X7013FXI85.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ab40b581d6ea4f9cbd231059cb67889_JaffaCakes118

  • Size

    79KB

  • Sample

    240527-11vxsabg9w

  • MD5

    7ab40b581d6ea4f9cbd231059cb67889

  • SHA1

    8307b3e6daf662a85b1ea284b5e26e40232f5b8d

  • SHA256

    76258e61268d9f6bd295237be0d8b756f0f830926ff35b49f37ecc8d57e6d4fd

  • SHA512

    e3688b2bfdda46e902d94a60b70c6a74d92572ba3c5d55077c52a0199d3f068c4e221d36555a54e7cb8b64a43ef1030c318f2dfe1df09b19df3f62fc4ea07b1f

  • SSDEEP

    1536:i9FVFNrZLXB6tBXAUFW9LkoGwNAd4ANdY8dVyyMK3phgqi4D:eTrLg3DoGf4q28dUhwpSCD

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://kompy.cba.pl/gif/lN_dl/
exe.dropper

http://fisiobianchini.com.br/wp-content/uploads/2016/05/S_U/
exe.dropper

http://dev.dimatech.org/wp-admin/Hu_jj/
exe.dropper

http://juangrela.com/admin/bB_m/
exe.dropper

http://coupedecheveux.org/yu71t1x/c_V/

Targets

    • Target

      UPS-X7013FXI85.js

    • Size

      166KB

    • MD5

      2ead130d4e6ff9f1e2f61888563b29c0

    • SHA1

      90ef697d3e1717af5a1659f4827452760ed1f120

    • SHA256

      9d638e393cf9c49ee287c8580b501b52b0db09aa60e03668d04c25f608d70a9c

    • SHA512

      561c7ccd015aba34dff29a41a635bda93831a32151f2836f3188a48f11e72f20493c063a7161a831e12294ff8658d548dc7ed9e02fdf4216dff1c60552ba6e57

    • SSDEEP

      3072:w77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qvIlc5hlPOwy7/FswxoLL5R:w77HUUUUUUUUUUUUUUUUUUUT52VJcPlv

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks