Overview

overview

10

Static

static

1

ede01e38b3...18.doc

windows7-x64

10

ede01e38b3...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ede01e38b308bd23c693339b34a81f38_JaffaCakes118

  • Size

    197KB

  • Sample

    240920-srfshatekq

  • MD5

    ede01e38b308bd23c693339b34a81f38

  • SHA1

    97b1b3d1821a5d49baacbd56cf9511ca7c41be2f

  • SHA256

    6d3d32f94e8c49634c93ac96bf0b6ef4bb3dc49696aef545f990d19752a027e5

  • SHA512

    2082a7ab6d25eb7a8373c0ca70475f03e9e1093568ded48a983b6eee7f97823eb0e6302c15b41ae45a2ad45f9972ad8c47b69f3cda25d29c7ebfa394f2926354

  • SSDEEP

    3072:It9ufstRUUKSns8T00JSHUgteMJ8qMD7gRycwR0PK2zkG:It9ufsfgIf0pLlwRAYG

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://fulfillmententertainment.com/cgi-bin/WrD/
exe.dropper

https://www.getwayimmigration.com/vqg1j3/1BwbZNN/
exe.dropper

http://vidadohomem.com/wp-content/O2ir3vx/
exe.dropper

http://analyticscosm.com/cgi-bin/PwlMy/
exe.dropper

http://www.angiathinh.com/wp-admin/KpNfK/
exe.dropper

http://twoparrot.com/wp-includes/s7aGv/
exe.dropper

http://ieee-acts.com/mainpage/vG/

Targets

    • Target

      ede01e38b308bd23c693339b34a81f38_JaffaCakes118

    • Size

      197KB

    • MD5

      ede01e38b308bd23c693339b34a81f38

    • SHA1

      97b1b3d1821a5d49baacbd56cf9511ca7c41be2f

    • SHA256

      6d3d32f94e8c49634c93ac96bf0b6ef4bb3dc49696aef545f990d19752a027e5

    • SHA512

      2082a7ab6d25eb7a8373c0ca70475f03e9e1093568ded48a983b6eee7f97823eb0e6302c15b41ae45a2ad45f9972ad8c47b69f3cda25d29c7ebfa394f2926354

    • SSDEEP

      3072:It9ufstRUUKSns8T00JSHUgteMJ8qMD7gRycwR0PK2zkG:It9ufsfgIf0pLlwRAYG

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks