Overview

overview

10

Static

static

1

873dd790c5...18.doc

windows7-x64

10

873dd790c5...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    873dd790c585982c538206eaaf3a59e5_JaffaCakes118

  • Size

    170KB

  • Sample

    240810-xfrsvawhqe

  • MD5

    873dd790c585982c538206eaaf3a59e5

  • SHA1

    53266107b60a025f15fd0d63e337a605a1412e4b

  • SHA256

    dc3e3fef5b584cbf8e923630c4a9ccf834c5140265e79ca13ade90150f9bc1fa

  • SHA512

    bc75157e9a9c4a800d57fdf2b7a4c9ec290b375b01af9c95e70a0b532b0d575776b8b07389b9715b86136d12c850a8411f0de0205ac782e7cad7f9550382b53d

  • SSDEEP

    1536:tB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5F+a9/IsVfS6oj5yE:t22TWTogk079THcpOu5UZhIsViNyE

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://riandutra.com/img/o9o/
exe.dropper

http://amyemitchell.com/themes/d3i/
exe.dropper

https://www.pxid360.com/wp-admin/w6X/
exe.dropper

http://zheliyouyy.com/wp-admin/3B/
exe.dropper

http://advanceddisposalsolutions.com/wp-includes/l/
exe.dropper

http://crazymut.com/d1ad_1a7z_jg4hewt/qWT/
exe.dropper

https://santyago.org/wp-content/qq/

Targets

    • Target

      873dd790c585982c538206eaaf3a59e5_JaffaCakes118

    • Size

      170KB

    • MD5

      873dd790c585982c538206eaaf3a59e5

    • SHA1

      53266107b60a025f15fd0d63e337a605a1412e4b

    • SHA256

      dc3e3fef5b584cbf8e923630c4a9ccf834c5140265e79ca13ade90150f9bc1fa

    • SHA512

      bc75157e9a9c4a800d57fdf2b7a4c9ec290b375b01af9c95e70a0b532b0d575776b8b07389b9715b86136d12c850a8411f0de0205ac782e7cad7f9550382b53d

    • SSDEEP

      1536:tB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5F+a9/IsVfS6oj5yE:t22TWTogk079THcpOu5UZhIsViNyE

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks