Overview

overview

10

Static

static

8

fb805a5139...18.doc

windows7-x64

10

fb805a5139...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb805a5139efa1580dae6829b24b7078_JaffaCakes118

  • Size

    75KB

  • Sample

    240928-e2wd2szbjg

  • MD5

    fb805a5139efa1580dae6829b24b7078

  • SHA1

    0d13a6d0c94b946882de78c7e6507b76e650033d

  • SHA256

    94de7534a45275daa06e0189c6bd06ca41176b3da93303b5fae677ae92cbb92d

  • SHA512

    565189a818df059c69c417361ec86a7bfe9c1bdf0628fbef1aeefcdd6bc5e59c3a7f29e1e60ae21ddea3f88ec232fa5f56661401452549cb3fc9fcbad17ff2a4

  • SSDEEP

    768:0cWVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBt+1o9k2p1qrOhdrCv+Y:0pocn1kp59gxBK85fBt+a9yOhg

Score
10/10
discoveryexecutionmacro

Malware Config

Targets

    • Target

      fb805a5139efa1580dae6829b24b7078_JaffaCakes118

    • Size

      75KB

    • MD5

      fb805a5139efa1580dae6829b24b7078

    • SHA1

      0d13a6d0c94b946882de78c7e6507b76e650033d

    • SHA256

      94de7534a45275daa06e0189c6bd06ca41176b3da93303b5fae677ae92cbb92d

    • SHA512

      565189a818df059c69c417361ec86a7bfe9c1bdf0628fbef1aeefcdd6bc5e59c3a7f29e1e60ae21ddea3f88ec232fa5f56661401452549cb3fc9fcbad17ff2a4

    • SSDEEP

      768:0cWVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBt+1o9k2p1qrOhdrCv+Y:0pocn1kp59gxBK85fBt+a9yOhg

    Score
    10/10
    discoveryexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks