Overview

overview

10

Static

static

8

90f93a0379...18.doc

windows7-x64

10

90f93a0379...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    90f93a037983ecfbd69c6706931dc530_JaffaCakes118
  • Size 76KB
  • Sample240603-jfamnshd82
  • SHA256 31e3fc47f0846cce98cedf0a6a8c1a8224b3350c26254982cc9786ec5c9982bc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://dunworth.com/vEgbzlAiD/
  • exe.dropper

    http://wernerbernheim.com.uy/capacitacion/bMLTBrcIE/
  • exe.dropper

    http://vereb.com/SOghVS/
  • exe.dropper

    http://hocompro.com/JlTszW/
  • exe.dropper

    http://okiembociana.pl/ihCgGO/

Targets

    • Target
      90f93a037983ecfbd69c6706931dc530_JaffaCakes118
    • Size 76KB
    • SHA256 31e3fc47f0846cce98cedf0a6a8c1a8224b3350c26254982cc9786ec5c9982bc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks