Overview

overview

10

Static

static

8

7e3a27b6ae...18.doc

windows7-x64

10

7e3a27b6ae...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7e3a27b6ae6d5c5c257674f4900c1010_JaffaCakes118

  • Size

    154KB

  • Sample

    240528-ys9d4abd43

  • MD5

    7e3a27b6ae6d5c5c257674f4900c1010

  • SHA1

    6b048d250efad99aaa73828672911b1d3453e2bc

  • SHA256

    4e194eb7d4d431f2639472339e07f462e51df265e1681349a519dfae98b8048d

  • SHA512

    f554dfb850f564c942d691fca739adc66cb4b2a19b318bd5d92ccac47fdb526ce769345d591d43b88180a647ed889b2c6b530e64e229195567d68fabff1adc14

  • SSDEEP

    1536:gURA+F6URA+Fhrdi1Ir77zOH98Wj2gpngd+a9rxQIY0y+WbXw:frfrzOH98ipgTxDH7AXw

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://qstride.com/img/1W/
exe.dropper

http://syracusecoffee.com/customer/i/
exe.dropper

http://shahrakyar.com/cms/3e/
exe.dropper

http://vuatritue.com/wp-admin/FkX/
exe.dropper

http://glafka.com/wp-content/2L7/
exe.dropper

http://rovrooftiles.com/wp-includes/nDP/
exe.dropper

http://paulospainting.com/wp-includes/7k/

Targets

    • Target

      7e3a27b6ae6d5c5c257674f4900c1010_JaffaCakes118

    • Size

      154KB

    • MD5

      7e3a27b6ae6d5c5c257674f4900c1010

    • SHA1

      6b048d250efad99aaa73828672911b1d3453e2bc

    • SHA256

      4e194eb7d4d431f2639472339e07f462e51df265e1681349a519dfae98b8048d

    • SHA512

      f554dfb850f564c942d691fca739adc66cb4b2a19b318bd5d92ccac47fdb526ce769345d591d43b88180a647ed889b2c6b530e64e229195567d68fabff1adc14

    • SSDEEP

      1536:gURA+F6URA+Fhrdi1Ir77zOH98Wj2gpngd+a9rxQIY0y+WbXw:frfrzOH98ipgTxDH7AXw

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks