Overview

overview

10

Static

static

8

JaffaCakes...4a.xls

windows7-x64

10

JaffaCakes...4a.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_770034c50bb98c5b1fca378a18fa5d4a

  • Size

    84KB

  • Sample

    250315-s39vqaw1fv

  • MD5

    770034c50bb98c5b1fca378a18fa5d4a

  • SHA1

    7f6cccf4e9864314a6380187cf014eee82e2eb5e

  • SHA256

    c5547db4d0d78e2875757726cba34e96dcd6109eb5d3ba4f838d6b251dba1d17

  • SHA512

    111d9f8345296811e453c299dfde298ad4ec1d96dc22909ce092aacb192fa42995fb8cf2b8430285d3f8df50b44284e902a46c29f2c5b86fa9a753c9260aeafd

  • SSDEEP

    1536:ymmmWSV5WVbrzQ7Io8cpDukbA23vM88ScJtXwgpMu:jWVbrzQ7I5cDukZEjhJtXwLu

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      JaffaCakes118_770034c50bb98c5b1fca378a18fa5d4a

    • Size

      84KB

    • MD5

      770034c50bb98c5b1fca378a18fa5d4a

    • SHA1

      7f6cccf4e9864314a6380187cf014eee82e2eb5e

    • SHA256

      c5547db4d0d78e2875757726cba34e96dcd6109eb5d3ba4f838d6b251dba1d17

    • SHA512

      111d9f8345296811e453c299dfde298ad4ec1d96dc22909ce092aacb192fa42995fb8cf2b8430285d3f8df50b44284e902a46c29f2c5b86fa9a753c9260aeafd

    • SSDEEP

      1536:ymmmWSV5WVbrzQ7Io8cpDukbA23vM88ScJtXwgpMu:jWVbrzQ7I5cDukZEjhJtXwLu

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks