Overview

overview

10

Static

static

8

a39c40c95f...18.doc

windows7-x64

10

a39c40c95f...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a39c40c95f6a85b573d18668c83cb71c_JaffaCakes118
  • Size 178KB
  • Sample240613-dg65dasbpd
  • SHA256 9c3f81236f7fcb19d6e1304ad6c89255461a66f783e372f62c8fc93fa4bfcd8e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://www.hhbiao.com/ro/hEGGg/
  • exe.dropper

    https://kissanime24.com/anime/tnqblnm875789/
  • exe.dropper

    http://ahansatan.com/wp-admin/IPTpsJjvkKHDM/
  • exe.dropper

    http://goldoni.co.uk/bmnfg411/qQmxCDIzDcR/
  • exe.dropper

    http://hirken.com.au/images/kul5uy3a48/
  • exe.dropper

    http://hofhuistechniek.nl/localhost/ZDN9mtkv7hsl25097064/
  • exe.dropper

    http://itcnt.com.np/2xk_kxs_r3u3g4/u2ka4qa5362685/

Targets

    • Target
      a39c40c95f6a85b573d18668c83cb71c_JaffaCakes118
    • Size 178KB
    • SHA256 9c3f81236f7fcb19d6e1304ad6c89255461a66f783e372f62c8fc93fa4bfcd8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks