Overview

overview

10

Static

static

8

JaffaCakes...95.xls

windows7-x64

10

JaffaCakes...95.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6c855fa474e62d6f1856db1ad5e8e095

  • Size

    132KB

  • Sample

    250312-wthxeszqv5

  • MD5

    6c855fa474e62d6f1856db1ad5e8e095

  • SHA1

    9807ff0ca2cd9c9b5ae1de7afd2934226005e201

  • SHA256

    bcc6271fbd159bf8ad8fcff4d49663dc3439a571ac4962b7d7eef0bf136c226f

  • SHA512

    02da8ec45713588bdb48988983c4dfb59148d1e05ccd7bb714f54d44d36f8114e892b96bccdf6e51eceebc91ca6dee5e530dd06ad627c4be27fb3f97923cde0c

  • SSDEEP

    3072:CXTzzbYb6nhTWVbrzQ7ITkDZTJtXwPTv4:QTvbYb6nhf

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      JaffaCakes118_6c855fa474e62d6f1856db1ad5e8e095

    • Size

      132KB

    • MD5

      6c855fa474e62d6f1856db1ad5e8e095

    • SHA1

      9807ff0ca2cd9c9b5ae1de7afd2934226005e201

    • SHA256

      bcc6271fbd159bf8ad8fcff4d49663dc3439a571ac4962b7d7eef0bf136c226f

    • SHA512

      02da8ec45713588bdb48988983c4dfb59148d1e05ccd7bb714f54d44d36f8114e892b96bccdf6e51eceebc91ca6dee5e530dd06ad627c4be27fb3f97923cde0c

    • SSDEEP

      3072:CXTzzbYb6nhTWVbrzQ7ITkDZTJtXwPTv4:QTvbYb6nhf

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks