Overview

overview

10

Static

static

1

ee17e811a8...18.doc

windows7-x64

10

ee17e811a8...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee17e811a8b3b51fdbe67074e4a0f043_JaffaCakes118

  • Size

    152KB

  • Sample

    240920-v4p8tayfkj

  • MD5

    ee17e811a8b3b51fdbe67074e4a0f043

  • SHA1

    9791a58731026151f3ae03ab2ebebd0934869701

  • SHA256

    296e01c69a440c587753a3450ab78b2694c10d70a15a86841284371fdbfc88c3

  • SHA512

    08cb72f52032540c841bd8e4b15394ec87bc3dc6d28efa7dc54d68e7be06356c498f969001a60169eabc10b7df04ea9785c91f5feadbd1e583728a888f0440d1

  • SSDEEP

    1536:oSGB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5p+a9SPKv9knJbGru:oz22TWTogk079THcpOu5UZ05UoOkqxk

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://armahouse.com/wp-includes/0/
exe.dropper

http://bitbenderz.com/ali/4Lo/
exe.dropper

http://lagera.com/images/W/
exe.dropper

http://msmartyford.com/assets/OI/
exe.dropper

http://geisterhouse.com/cgi-bin/FE/
exe.dropper

https://konican.com/cgi-bin/nFK/
exe.dropper

https://coolcomputers.info/LLC/zD/

Targets

    • Target

      ee17e811a8b3b51fdbe67074e4a0f043_JaffaCakes118

    • Size

      152KB

    • MD5

      ee17e811a8b3b51fdbe67074e4a0f043

    • SHA1

      9791a58731026151f3ae03ab2ebebd0934869701

    • SHA256

      296e01c69a440c587753a3450ab78b2694c10d70a15a86841284371fdbfc88c3

    • SHA512

      08cb72f52032540c841bd8e4b15394ec87bc3dc6d28efa7dc54d68e7be06356c498f969001a60169eabc10b7df04ea9785c91f5feadbd1e583728a888f0440d1

    • SSDEEP

      1536:oSGB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5p+a9SPKv9knJbGru:oz22TWTogk079THcpOu5UZ05UoOkqxk

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks