Overview

overview

10

Static

static

8

c03f55601e...18.doc

windows7-x64

10

c03f55601e...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c03f55601ec15a73f7d945872a963755_JaffaCakes118
  • Size 197KB
  • Sample240825-jczgmathrm
  • SHA256 6b4419d45974ab12fe3b7374e5821a249e8b7b426bb15389e6f70897ae85f630
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discoverymacro

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://amvp-py.com/amvp/r/
  • exe.dropper

    https://dagranitegiare.com/wp-admin/d/
  • exe.dropper

    https://emitt-tech.com/wp-admin/2qG/
  • exe.dropper

    http://kvaser-microsite.tagsom.company/wp-includes/a/
  • exe.dropper

    https://aravindhherbalstore.com/wp-admin/TPA/
  • exe.dropper

    http://leo.jelct.com/wp-content/Hce/
  • exe.dropper

    http://domiciliazione.org/wp/UT8/

Targets

    • Target
      c03f55601ec15a73f7d945872a963755_JaffaCakes118
    • Size 197KB
    • SHA256 6b4419d45974ab12fe3b7374e5821a249e8b7b426bb15389e6f70897ae85f630
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks