Overview

overview

10

Static

static

8

dc2e12f5cb...18.xls

windows7-x64

10

dc2e12f5cb...18.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc2e12f5cbaa6953bbaee98ef7651504_JaffaCakes118

  • Size

    125KB

  • Sample

    241210-aqyyks1rgm

  • MD5

    dc2e12f5cbaa6953bbaee98ef7651504

  • SHA1

    6550ed4a8fa0ed2f4aa5640f2f73c0bcadcc17a8

  • SHA256

    e3579c554233c38ec4824e0f798742892335f81b954f7bb98992cda5bb928717

  • SHA512

    61a6b5c24ffc21f5ba5d0c3e28dbd0e6ca4f94ae5171d4a4ee4c097ec42574d6104d176c9c4e9a5d0f525fbb9c39c65f90a7760d1440ecd697e95249bffe01ad

  • SSDEEP

    1536:NXXXzUPaT3LehKpR0dYFZpWVbrzQ7ITkR62ldM88ScJtXwReM2M/MPIU:GaT36hS7WVbrzQ7ITk9EjhJtXwf5kQU

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      dc2e12f5cbaa6953bbaee98ef7651504_JaffaCakes118

    • Size

      125KB

    • MD5

      dc2e12f5cbaa6953bbaee98ef7651504

    • SHA1

      6550ed4a8fa0ed2f4aa5640f2f73c0bcadcc17a8

    • SHA256

      e3579c554233c38ec4824e0f798742892335f81b954f7bb98992cda5bb928717

    • SHA512

      61a6b5c24ffc21f5ba5d0c3e28dbd0e6ca4f94ae5171d4a4ee4c097ec42574d6104d176c9c4e9a5d0f525fbb9c39c65f90a7760d1440ecd697e95249bffe01ad

    • SSDEEP

      1536:NXXXzUPaT3LehKpR0dYFZpWVbrzQ7ITkR62ldM88ScJtXwReM2M/MPIU:GaT36hS7WVbrzQ7ITk9EjhJtXwf5kQU

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks