Overview

overview

10

Static

static

8

43c1e6a8ff...18.xls

windows7-x64

10

43c1e6a8ff...18.xls

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    43c1e6a8ffc7a66d9a875883675bc94c_JaffaCakes118

  • Size

    333KB

  • Sample

    241014-xvw14svglr

  • MD5

    43c1e6a8ffc7a66d9a875883675bc94c

  • SHA1

    6770f7f28472275d950273cca596add579032be0

  • SHA256

    a0068a0869f0a81cdb8a6ec5190bd71d0130f657daeff648424a9db2a14ea2d0

  • SHA512

    67bb5f538ecb6d2e534507b584e3b8ccfc77c3b4de859435803c463e696227b4a5c558aaf523b02db2ecb8dc5675540c726519d177fd94e2e7a9c3ffcf79ff48

  • SSDEEP

    3072:812qeqtVW/A23SSZWLTF4f2jcc0lbxOr1ga6AnP67l:9q03BWqTQS

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      43c1e6a8ffc7a66d9a875883675bc94c_JaffaCakes118

    • Size

      333KB

    • MD5

      43c1e6a8ffc7a66d9a875883675bc94c

    • SHA1

      6770f7f28472275d950273cca596add579032be0

    • SHA256

      a0068a0869f0a81cdb8a6ec5190bd71d0130f657daeff648424a9db2a14ea2d0

    • SHA512

      67bb5f538ecb6d2e534507b584e3b8ccfc77c3b4de859435803c463e696227b4a5c558aaf523b02db2ecb8dc5675540c726519d177fd94e2e7a9c3ffcf79ff48

    • SSDEEP

      3072:812qeqtVW/A23SSZWLTF4f2jcc0lbxOr1ga6AnP67l:9q03BWqTQS

    Score
    10/10
    defense_evasiondiscovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks