Overview

overview

10

Static

static

8

96c4f3078c...18.msg

windows7-x64

5

96c4f3078c...18.msg

windows10-2004-x64

3

INV-3DP24809.doc

windows7-x64

10

INV-3DP24809.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    96c4f3078c25578a6cd3ec94d6feea26_JaffaCakes118

  • Size

    114KB

  • Sample

    240605-atd3ksge6z

  • MD5

    96c4f3078c25578a6cd3ec94d6feea26

  • SHA1

    fd9ad9627597de92889727440a7a2f99ecd5355c

  • SHA256

    0cda278d2bf980b3a4558ed0aac3a6512aa1245e73324c5da76be7227297798f

  • SHA512

    7a8966cf9c1f44f73505695de50d492361dff66a1876576606f1dfdaebbf65bee3cd7abec60e2df49762ec078ba20ab57d0957b8d54c74c16f75be73c0aeb803

  • SSDEEP

    1536:ffNXQuigY+9Socn1kp59gxBK85fBt+a9rPBZ:Dd41k/W48ZP

Score
10/10
macro

Malware Config

Targets

    • Target

      96c4f3078c25578a6cd3ec94d6feea26_JaffaCakes118

    • Size

      114KB

    • MD5

      96c4f3078c25578a6cd3ec94d6feea26

    • SHA1

      fd9ad9627597de92889727440a7a2f99ecd5355c

    • SHA256

      0cda278d2bf980b3a4558ed0aac3a6512aa1245e73324c5da76be7227297798f

    • SHA512

      7a8966cf9c1f44f73505695de50d492361dff66a1876576606f1dfdaebbf65bee3cd7abec60e2df49762ec078ba20ab57d0957b8d54c74c16f75be73c0aeb803

    • SSDEEP

      1536:ffNXQuigY+9Socn1kp59gxBK85fBt+a9rPBZ:Dd41k/W48ZP

    Score
    5/10

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      INV-3DP24809.doc

    • Size

      75KB

    • MD5

      9225e38cb2ac8cc72f65d862e5dd7003

    • SHA1

      ec6e48118f62f5e4c9322bab9b6bf5a36a336751

    • SHA256

      dda6fd8390483974892ef7423b44d74f843e32cfa3d15716fc8a5d554075b892

    • SHA512

      c0ab7843d9353718a8a44a71883b988e12f351427f28c5705d24481875dfc2dd90d847f4881e1b1b66359c525501429c22488cc908cd711c284f7ea13077343a

    • SSDEEP

      768:sTBSVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBt+1o9tcD2tAcnBnip:s9Socn1kp59gxBK85fBt+a9rPB

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks