Overview

overview

10

Static

static

8

JaffaCakes...25.xls

windows7-x64

10

JaffaCakes...25.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_74571c140b996d8a24dae2517a182d25

  • Size

    205KB

  • Sample

    250314-p9yt9a1xe1

  • MD5

    74571c140b996d8a24dae2517a182d25

  • SHA1

    786b293d45773918b1fe8a8f9e355a4a4845fba8

  • SHA256

    b91ff4b652f1096186b85933e56c53847efad80c9b43cafda49c1dfda9e79ad7

  • SHA512

    15bddb8f5898e4fee3442fddff43d467bea06140e204bcff6e1ff681a207461cee925cc3e07ced5e6712b6d68361cc41fdfdb4804b2b9a29e357fe9ae80156b0

  • SSDEEP

    6144:7vnRVTVDkdysFe71ERKXKhU3TZaA472byRW1N8xXImuForwR+RXgf5xSl7ZXGJwi:zRVTVDkdysFe71ERKXKhU3TZaA472byZ

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      JaffaCakes118_74571c140b996d8a24dae2517a182d25

    • Size

      205KB

    • MD5

      74571c140b996d8a24dae2517a182d25

    • SHA1

      786b293d45773918b1fe8a8f9e355a4a4845fba8

    • SHA256

      b91ff4b652f1096186b85933e56c53847efad80c9b43cafda49c1dfda9e79ad7

    • SHA512

      15bddb8f5898e4fee3442fddff43d467bea06140e204bcff6e1ff681a207461cee925cc3e07ced5e6712b6d68361cc41fdfdb4804b2b9a29e357fe9ae80156b0

    • SSDEEP

      6144:7vnRVTVDkdysFe71ERKXKhU3TZaA472byRW1N8xXImuForwR+RXgf5xSl7ZXGJwi:zRVTVDkdysFe71ERKXKhU3TZaA472byZ

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks