Overview

overview

10

Static

static

1

8b561633ea...18.doc

windows7-x64

10

8b561633ea...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8b561633eae816d387eb741a09b1cf3f_JaffaCakes118

  • Size

    171KB

  • Sample

    240811-v9y3xazdql

  • MD5

    8b561633eae816d387eb741a09b1cf3f

  • SHA1

    8d4e5e1e8828c18bb4b4f855a0e538a49532d14b

  • SHA256

    8b086b781acec12715982f30c39eb5d20950325e39a5d84b33a6df96d9edcf8c

  • SHA512

    73166cc229f9e3e20dbe17caa45ddfb8a23355826e85205bdc14fae5df56b9b2753c017885c1532e1da8d688a53534029c8f616f28ff6ac7b6344f7ab95237e6

  • SSDEEP

    1536:sB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5Z+a93WvrCv3Pt6DVn:s22TWTogk079THcpOu5UZ8vw3Pt6DVn

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://ckinterbiz.com/backup/waI0rNy/
exe.dropper

http://creationskateboards.com/shred/xnYp2/
exe.dropper

http://bnmintl.com/cgi-bin/hQuB2/
exe.dropper

http://buildingrobots.net/cgi-bin/LKgv/
exe.dropper

http://booksearch.com/index_files/U/
exe.dropper

http://davehale.ca/cgi-bin/v4kax/
exe.dropper

https://www.equiposjj.com/cgi-bin/h0MId/

Targets

    • Target

      8b561633eae816d387eb741a09b1cf3f_JaffaCakes118

    • Size

      171KB

    • MD5

      8b561633eae816d387eb741a09b1cf3f

    • SHA1

      8d4e5e1e8828c18bb4b4f855a0e538a49532d14b

    • SHA256

      8b086b781acec12715982f30c39eb5d20950325e39a5d84b33a6df96d9edcf8c

    • SHA512

      73166cc229f9e3e20dbe17caa45ddfb8a23355826e85205bdc14fae5df56b9b2753c017885c1532e1da8d688a53534029c8f616f28ff6ac7b6344f7ab95237e6

    • SSDEEP

      1536:sB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5Z+a93WvrCv3Pt6DVn:s22TWTogk079THcpOu5UZ8vw3Pt6DVn

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks