Overview

overview

10

Static

static

8

eaadbf33d6...8.xlsm

windows7-x64

10

eaadbf33d6...8.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eaadbf33d6d8e1df8106018fdc39d3f9_JaffaCakes118

  • Size

    2.7MB

  • Sample

    240919-f8w5latckp

  • MD5

    eaadbf33d6d8e1df8106018fdc39d3f9

  • SHA1

    8e95e02a998509003fea9c205e752e4ec2802808

  • SHA256

    a9ba5e7ae9dca585a8b3e993dba5055bffce24a5e201e5b9cdd6e88c2c33bb60

  • SHA512

    ab654653089c8c720e71d2f80670c3eade14cd55ef45d9c0c49f7fa146a6d08f28fbcda35331911d823df1a6000a4474573586b0e70aea160ab0eca81e7e8337

  • SSDEEP

    1536:lnd4uFEvT42ZacNCMi8LZ+lWxaqOyIasQmUV2ZT0nIcjELco6kx:r4uFEr423N7ipWJOyIj8sT0n9Jkx

Score
10/10
discoverymacro

Malware Config

Targets

    • Target

      eaadbf33d6d8e1df8106018fdc39d3f9_JaffaCakes118

    • Size

      2.7MB

    • MD5

      eaadbf33d6d8e1df8106018fdc39d3f9

    • SHA1

      8e95e02a998509003fea9c205e752e4ec2802808

    • SHA256

      a9ba5e7ae9dca585a8b3e993dba5055bffce24a5e201e5b9cdd6e88c2c33bb60

    • SHA512

      ab654653089c8c720e71d2f80670c3eade14cd55ef45d9c0c49f7fa146a6d08f28fbcda35331911d823df1a6000a4474573586b0e70aea160ab0eca81e7e8337

    • SSDEEP

      1536:lnd4uFEvT42ZacNCMi8LZ+lWxaqOyIasQmUV2ZT0nIcjELco6kx:r4uFEr423N7ipWJOyIj8sT0n9Jkx

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks