Overview

overview

10

Static

static

8

ee888a53a0...18.xls

windows7-x64

10

ee888a53a0...18.xls

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee888a53a0695e31c4d0c0e2cb6867d7_JaffaCakes118

  • Size

    103KB

  • Sample

    241214-nkz6casjfp

  • MD5

    ee888a53a0695e31c4d0c0e2cb6867d7

  • SHA1

    d788a078f7e2669a5952dbd63e396b89ec1e0274

  • SHA256

    d9e3cc4f295e7ef97c47563656aa65ad27eaad4cf791911f85ff0be6eec89e76

  • SHA512

    6923fd02962a8033de794e56386d4c3681a5c04c5a59e4a29144224771bbc583c294de344d5fe445577faf4b3ed5fcc8be198f9d65d457f69c7a94cf376400cf

  • SSDEEP

    1536:eXeeeeKzmjHoYMmEY+iWVbrzQ5kIoITkR629/COU/WwF1JxM2M/MwPLxh:UHbWVbrzQyJITk9FDWc5koh

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      ee888a53a0695e31c4d0c0e2cb6867d7_JaffaCakes118

    • Size

      103KB

    • MD5

      ee888a53a0695e31c4d0c0e2cb6867d7

    • SHA1

      d788a078f7e2669a5952dbd63e396b89ec1e0274

    • SHA256

      d9e3cc4f295e7ef97c47563656aa65ad27eaad4cf791911f85ff0be6eec89e76

    • SHA512

      6923fd02962a8033de794e56386d4c3681a5c04c5a59e4a29144224771bbc583c294de344d5fe445577faf4b3ed5fcc8be198f9d65d457f69c7a94cf376400cf

    • SSDEEP

      1536:eXeeeeKzmjHoYMmEY+iWVbrzQ5kIoITkR629/COU/WwF1JxM2M/MwPLxh:UHbWVbrzQyJITk9FDWc5koh

    Score
    10/10
    defense_evasiondiscovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks