Overview

overview

10

Static

static

8

a7dba3115b...18.doc

windows7-x64

10

a7dba3115b...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a7dba3115b5d621728ef122d032f611a_JaffaCakes118
  • Size 163KB
  • Sample240614-d2vbbaxejq
  • SHA256 bb2fd7f89d6de42a49049dbd2535a119323203510e6958fb12b04109c2f70433
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://dheeranet.com/Pej/
  • exe.dropper

    http://playschoolmatritva.com/cgi-bin/Uh/
  • exe.dropper

    http://dikshadayal.com/cgi-bin/Zl78esq/
  • exe.dropper

    http://new.mylicense.ca/5aiibj/vS2/
  • exe.dropper

    http://nucleokardecistalace.org.br/wp-includes/HviA/
  • exe.dropper

    http://britanniacricketleague.com/wp-admin/3qc8lQB/
  • exe.dropper

    https://www.hhbiao.com/ro/4Kh/

Targets

    • Target
      a7dba3115b5d621728ef122d032f611a_JaffaCakes118
    • Size 163KB
    • SHA256 bb2fd7f89d6de42a49049dbd2535a119323203510e6958fb12b04109c2f70433
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks