Overview

overview

10

Static

static

8

9cc1638692...18.doc

windows7-x64

10

9cc1638692...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9cc16386925319dd4b467a89dc10aa1b_JaffaCakes118
  • Size 186KB
  • Sample240611-c692ws1ejf
  • SHA256 576a1334ad99cf1d8913475a31a5cfd88e9234f041422c2f78f9f9ea3589ad80
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://ekokominki.pl/3vp4/l_Op/
  • exe.dropper

    https://giangphan.vn/evhu/s_t/
  • exe.dropper

    http://gkmfx.net/wp-admin/y_v/
  • exe.dropper

    http://dogmates.club/wp-content/uploads/fe_N/
  • exe.dropper

    http://www.iplaz.pt/wp-admin/W_D/

Targets

    • Target
      9cc16386925319dd4b467a89dc10aa1b_JaffaCakes118
    • Size 186KB
    • SHA256 576a1334ad99cf1d8913475a31a5cfd88e9234f041422c2f78f9f9ea3589ad80
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks