Overview

overview

10

Static

static

8

JaffaCakes...0d.xls

windows7-x64

10

JaffaCakes...0d.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6d46695976309ffe6eb6dc18928d9e0d

  • Size

    360KB

  • Sample

    250312-1q6xastzgv

  • MD5

    6d46695976309ffe6eb6dc18928d9e0d

  • SHA1

    fc26adf393c5108e8353ef55042a28482be2bf00

  • SHA256

    b6a6214ad7eb10ee3cfa57592579528d5d2cb376876c4513b08a091ac60fb9b2

  • SHA512

    655e7716cfaff981d94e78d1cc698e2c85859998a87ac364286ee5a87155300119d4af83d9b75dd6b8a328ccb7afba8e8bcafbd6adf1398854554aaee3152fe0

  • SSDEEP

    6144:r+l6Nc7yRzs1H75wkZUpFCaYWREOdO+jIcrOVnViuMMopoA/gnez5DP+J:mPx/SH

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      JaffaCakes118_6d46695976309ffe6eb6dc18928d9e0d

    • Size

      360KB

    • MD5

      6d46695976309ffe6eb6dc18928d9e0d

    • SHA1

      fc26adf393c5108e8353ef55042a28482be2bf00

    • SHA256

      b6a6214ad7eb10ee3cfa57592579528d5d2cb376876c4513b08a091ac60fb9b2

    • SHA512

      655e7716cfaff981d94e78d1cc698e2c85859998a87ac364286ee5a87155300119d4af83d9b75dd6b8a328ccb7afba8e8bcafbd6adf1398854554aaee3152fe0

    • SSDEEP

      6144:r+l6Nc7yRzs1H75wkZUpFCaYWREOdO+jIcrOVnViuMMopoA/gnez5DP+J:mPx/SH

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks