Overview

overview

10

Static

static

8

dcab0482f0...18.xls

windows7-x64

10

dcab0482f0...18.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dcab0482f019071dc72d68380cb94f54_JaffaCakes118

  • Size

    146KB

  • Sample

    241210-daerjswmgp

  • MD5

    dcab0482f019071dc72d68380cb94f54

  • SHA1

    047f343cd5594b54acb37e14336c3f587777afe8

  • SHA256

    1885a7e7e091f3363c7e809515a77bc9883f44bb6a81a539c852fd0d2438513c

  • SHA512

    e234d081f863cca83fb93449e2d64e3aa9aa271e6f51b9cd0d6e68ceca92c930f3812dd35c8f0d6af9915213e079b499401eb097af3e3d030aa192fb6d57f05a

  • SSDEEP

    3072:a/1Bbai7+WVbrzAZD7ITk9CU0JtXwk5k62TW:y3p7cDi

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      dcab0482f019071dc72d68380cb94f54_JaffaCakes118

    • Size

      146KB

    • MD5

      dcab0482f019071dc72d68380cb94f54

    • SHA1

      047f343cd5594b54acb37e14336c3f587777afe8

    • SHA256

      1885a7e7e091f3363c7e809515a77bc9883f44bb6a81a539c852fd0d2438513c

    • SHA512

      e234d081f863cca83fb93449e2d64e3aa9aa271e6f51b9cd0d6e68ceca92c930f3812dd35c8f0d6af9915213e079b499401eb097af3e3d030aa192fb6d57f05a

    • SSDEEP

      3072:a/1Bbai7+WVbrzAZD7ITk9CU0JtXwk5k62TW:y3p7cDi

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks