Overview

overview

10

Static

static

8

ed5183565f...18.doc

windows7-x64

10

ed5183565f...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed5183565faab7e6bd0ee42d71a23176_JaffaCakes118

  • Size

    155KB

  • Sample

    240920-lm8t6azfqn

  • MD5

    ed5183565faab7e6bd0ee42d71a23176

  • SHA1

    63abf22e0c2a5a3136f7dc4a0cb38a22fde834ef

  • SHA256

    316329970083b915103bcc7de04a100c7288018f8c5683974b02f2ec150001bb

  • SHA512

    951031b380bdcfc7eb83e2d51ebfa7d8390c36125cdf6cb9d879970e8c58817aebbc3834e982543e453b7c1b31dcec5aee07db64a43eeba30354391c9ec07318

  • SSDEEP

    1536:KAMOAMsrdi1Ir77zOH98Wj2gpngx+a94PzNWP5d6YQGXIcwu:wrfrzOH98ipgFP7vQGXIcwu

Score
10/10
discoverymacro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://kinotheque.com/wp-includes/os/
exe.dropper

http://vandamebuilders.com/wp-includes/Ess/
exe.dropper

http://raintoday.org/wp-admin/wm/
exe.dropper

https://intenswel.com/wp-content/qM1/
exe.dropper

https://himosaandnasa.com/lfnwz/um/
exe.dropper

http://buygrowtogether.com/amfxn/G4/
exe.dropper

https://xn--mgbao2hg.net/cgi-bin/1/

Targets

    • Target

      ed5183565faab7e6bd0ee42d71a23176_JaffaCakes118

    • Size

      155KB

    • MD5

      ed5183565faab7e6bd0ee42d71a23176

    • SHA1

      63abf22e0c2a5a3136f7dc4a0cb38a22fde834ef

    • SHA256

      316329970083b915103bcc7de04a100c7288018f8c5683974b02f2ec150001bb

    • SHA512

      951031b380bdcfc7eb83e2d51ebfa7d8390c36125cdf6cb9d879970e8c58817aebbc3834e982543e453b7c1b31dcec5aee07db64a43eeba30354391c9ec07318

    • SSDEEP

      1536:KAMOAMsrdi1Ir77zOH98Wj2gpngx+a94PzNWP5d6YQGXIcwu:wrfrzOH98ipgFP7vQGXIcwu

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks