Overview

overview

10

Static

static

1

ead95aa757...18.doc

windows7-x64

10

ead95aa757...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ead95aa757d0f5bc688f42f320d242eb_JaffaCakes118

  • Size

    141KB

  • Sample

    240919-jahq4axelq

  • MD5

    ead95aa757d0f5bc688f42f320d242eb

  • SHA1

    ab8cead6327f36e210255de97258fc740d14a185

  • SHA256

    3ac2fab6d38a1b39310ed1c690ee400a2e3fe82c6c762a2c0d795a4140586832

  • SHA512

    cd8aa77603af7c37856a08af258df77119a984076e7205f5aa2fae1334e1f0516a9304935cdf307cbec9c707cdd11f707515b78d67476aad8aa1eca8587896c7

  • SSDEEP

    1536:ALRD3bNqfNpu39IId5a6XP3Mg8afCqmOoF3Cgar3Pd0MZXiNjLooT:8R1qf69xak3MgxCkoMFr3Pd0MZXiNPvT

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://shop.mtcss.co.uk/wp-admin/USQFPj/
exe.dropper

https://handfinger.com/wp-includes/iCY/
exe.dropper

http://hanulmotors.com/nbqso/8Tz/
exe.dropper

http://helpinghands4needy.org/wp-content/LgrI9g/
exe.dropper

http://www.ecobaratocanaria.com/wordpress/Jt/
exe.dropper

http://macerindia.com/wp-content/hRS/
exe.dropper

http://cfn.tvstartup.com/wp-content/7dNH1LI/

Targets

    • Target

      ead95aa757d0f5bc688f42f320d242eb_JaffaCakes118

    • Size

      141KB

    • MD5

      ead95aa757d0f5bc688f42f320d242eb

    • SHA1

      ab8cead6327f36e210255de97258fc740d14a185

    • SHA256

      3ac2fab6d38a1b39310ed1c690ee400a2e3fe82c6c762a2c0d795a4140586832

    • SHA512

      cd8aa77603af7c37856a08af258df77119a984076e7205f5aa2fae1334e1f0516a9304935cdf307cbec9c707cdd11f707515b78d67476aad8aa1eca8587896c7

    • SSDEEP

      1536:ALRD3bNqfNpu39IId5a6XP3Mg8afCqmOoF3Cgar3Pd0MZXiNjLooT:8R1qf69xak3MgxCkoMFr3Pd0MZXiNPvT

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks