Overview

overview

10

Static

static

8

JaffaCakes...f5.xls

windows7-x64

10

JaffaCakes...f5.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6b2b9d42581d755c3f423a3a273796f5

  • Size

    296KB

  • Sample

    250312-p7a1ea1tbs

  • MD5

    6b2b9d42581d755c3f423a3a273796f5

  • SHA1

    cfdc7aa01f169b4995d7f4dea63fe88264ba5069

  • SHA256

    0fe6d78e321028b931c3c1dbc467b2db424a333803f06db7f60311d11b15917f

  • SHA512

    1657ee63f2fcff6febbe6020bc9a602c259bf9d53ad6b2a4cbed1cdd6f42ec384c6bd90b9ca9b2b54e1328225364ff6ee81bcd52d14fca6e2ca41da24aa3f80a

  • SSDEEP

    6144:rf5VC9ECYkyTClYAZfcBvEHVwbPgcUk9l0uq0l+65Xo/5jW:rfD1CWWEiybPgz5M2/5

Score
10/10
defense_evasiondiscoverymacromacro_on_actionpersistencexlm

Malware Config

Targets

    • Target

      JaffaCakes118_6b2b9d42581d755c3f423a3a273796f5

    • Size

      296KB

    • MD5

      6b2b9d42581d755c3f423a3a273796f5

    • SHA1

      cfdc7aa01f169b4995d7f4dea63fe88264ba5069

    • SHA256

      0fe6d78e321028b931c3c1dbc467b2db424a333803f06db7f60311d11b15917f

    • SHA512

      1657ee63f2fcff6febbe6020bc9a602c259bf9d53ad6b2a4cbed1cdd6f42ec384c6bd90b9ca9b2b54e1328225364ff6ee81bcd52d14fca6e2ca41da24aa3f80a

    • SSDEEP

      6144:rf5VC9ECYkyTClYAZfcBvEHVwbPgcUk9l0uq0l+65Xo/5jW:rfD1CWWEiybPgz5M2/5

    Score
    10/10
    defense_evasiondiscoverymacromacro_on_actionpersistencexlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Office macro that triggers on suspicious action

      Office document macro which triggers in special circumstances - often malicious.

      macromacro_on_action

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks