Overview

overview

10

Static

static

8

eaa7a72ad0...18.xls

windows7-x64

10

eaa7a72ad0...18.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eaa7a72ad0dadf2944625404aced6b8d_JaffaCakes118

  • Size

    88KB

  • Sample

    241213-j15zbavjhq

  • MD5

    eaa7a72ad0dadf2944625404aced6b8d

  • SHA1

    d71270637f395a7a60d23224539548476b47f1aa

  • SHA256

    773743fde9a060df7e1720d7a373a6abf0666e2b9b5b87f1e147da29184839e6

  • SHA512

    16f7fe531eb224939a78fd450c502e88157ce2d19bd53230919692cd0b79a1fc4b50641a402b49f40c9dd144045d7d6534bb2e7c8d95e81561f6ca2ea47f65d0

  • SSDEEP

    1536:exs4hmTaqi2jcc0lbxOqTgZ2IhY7nJdJoOd7cJKXwfIKp:t62jcc0lbxOKm2AJKXwFp

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      eaa7a72ad0dadf2944625404aced6b8d_JaffaCakes118

    • Size

      88KB

    • MD5

      eaa7a72ad0dadf2944625404aced6b8d

    • SHA1

      d71270637f395a7a60d23224539548476b47f1aa

    • SHA256

      773743fde9a060df7e1720d7a373a6abf0666e2b9b5b87f1e147da29184839e6

    • SHA512

      16f7fe531eb224939a78fd450c502e88157ce2d19bd53230919692cd0b79a1fc4b50641a402b49f40c9dd144045d7d6534bb2e7c8d95e81561f6ca2ea47f65d0

    • SSDEEP

      1536:exs4hmTaqi2jcc0lbxOqTgZ2IhY7nJdJoOd7cJKXwfIKp:t62jcc0lbxOKm2AJKXwFp

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks