Overview

overview

10

Static

static

8

d9b55e70ec...18.xls

windows7-x64

10

d9b55e70ec...18.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9b55e70ecb67c825d0da5dc5eda2daf_JaffaCakes118

  • Size

    143KB

  • Sample

    241209-p336dsxqbx

  • MD5

    d9b55e70ecb67c825d0da5dc5eda2daf

  • SHA1

    31a733754fbd8ed298bcaa1c811ef98cd152884f

  • SHA256

    159e1a2e25ed59c5d13adec2e381dcca9461e27bb069d0e0f04f34ed2c42acda

  • SHA512

    ebb0b4f9f5ff8fa7075465ec39466f90122b11e171fc818586d5aac778914ac4c272212606158ca7e45d54fcd2c7cddfe881cc98c86e98a9a5727331d4798918

  • SSDEEP

    3072:BW42vWVbrzQ7ITk9B2AJtXwr5k0mfEifNdk:z2Qk

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      d9b55e70ecb67c825d0da5dc5eda2daf_JaffaCakes118

    • Size

      143KB

    • MD5

      d9b55e70ecb67c825d0da5dc5eda2daf

    • SHA1

      31a733754fbd8ed298bcaa1c811ef98cd152884f

    • SHA256

      159e1a2e25ed59c5d13adec2e381dcca9461e27bb069d0e0f04f34ed2c42acda

    • SHA512

      ebb0b4f9f5ff8fa7075465ec39466f90122b11e171fc818586d5aac778914ac4c272212606158ca7e45d54fcd2c7cddfe881cc98c86e98a9a5727331d4798918

    • SSDEEP

      3072:BW42vWVbrzQ7ITk9B2AJtXwr5k0mfEifNdk:z2Qk

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks