Overview

overview

10

Static

static

8

de03f2b1c1...18.xls

windows7-x64

10

de03f2b1c1...18.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de03f2b1c1b13cf8e0cbb4818cf8c12c_JaffaCakes118

  • Size

    85KB

  • Sample

    241210-wmgqsasjhx

  • MD5

    de03f2b1c1b13cf8e0cbb4818cf8c12c

  • SHA1

    deed5efa59761e76661470b87e8520acedce952e

  • SHA256

    db936924f807df5b2197b9e4443da196f8a561a137b136db48987163723542ae

  • SHA512

    bc9c97f6c7721db5481aa8d749efb4ea30f143e7e9739a8a7d71225945daeec4eb0c25c0dffd992133e44d9003ed45965b1e0b9fa229c3708acde99d258059d6

  • SSDEEP

    1536:4sss2T4u4WVbrzQ7ImZe7WDkbA23fM88ScJtXJK4NO:DWVbrzQ7ImuWDkZUjhJtXJTO

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      de03f2b1c1b13cf8e0cbb4818cf8c12c_JaffaCakes118

    • Size

      85KB

    • MD5

      de03f2b1c1b13cf8e0cbb4818cf8c12c

    • SHA1

      deed5efa59761e76661470b87e8520acedce952e

    • SHA256

      db936924f807df5b2197b9e4443da196f8a561a137b136db48987163723542ae

    • SHA512

      bc9c97f6c7721db5481aa8d749efb4ea30f143e7e9739a8a7d71225945daeec4eb0c25c0dffd992133e44d9003ed45965b1e0b9fa229c3708acde99d258059d6

    • SSDEEP

      1536:4sss2T4u4WVbrzQ7ImZe7WDkbA23fM88ScJtXJK4NO:DWVbrzQ7ImuWDkZUjhJtXJTO

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks