Overview

overview

10

Static

static

8

JaffaCakes...58.xls

windows7-x64

10

JaffaCakes...58.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8da93f2c184247b886fee3ac1b17eb58

  • Size

    95KB

  • Sample

    250329-v3xw9syky5

  • MD5

    8da93f2c184247b886fee3ac1b17eb58

  • SHA1

    d6e6cf2946c657f222501453d20fd86766545783

  • SHA256

    ba8990f92dd9680634d898be9d5a63ec42d89660a1f29a51147633307b1e9da5

  • SHA512

    38d62103fb0bc336e7870e9e8b16968c5a6e524ecf13bc3455936102779edeec337ede1d01f6e9dfa6ee2abfa1214c5c338ca54ac63ac6687e23b7007b653d77

  • SSDEEP

    1536:eeeeeqWfeOQzJtV8cbsQvPe8k1SLz459mYqNAOIbkWVbrzQ7ITkPBx2sKt8pcJtk:eExWVbrzQ7ITky18CJtXweQN

Score
10/10
defense_evasiondiscoverymacroxlm

Malware Config

Targets

    • Target

      JaffaCakes118_8da93f2c184247b886fee3ac1b17eb58

    • Size

      95KB

    • MD5

      8da93f2c184247b886fee3ac1b17eb58

    • SHA1

      d6e6cf2946c657f222501453d20fd86766545783

    • SHA256

      ba8990f92dd9680634d898be9d5a63ec42d89660a1f29a51147633307b1e9da5

    • SHA512

      38d62103fb0bc336e7870e9e8b16968c5a6e524ecf13bc3455936102779edeec337ede1d01f6e9dfa6ee2abfa1214c5c338ca54ac63ac6687e23b7007b653d77

    • SSDEEP

      1536:eeeeeqWfeOQzJtV8cbsQvPe8k1SLz459mYqNAOIbkWVbrzQ7ITkPBx2sKt8pcJtk:eExWVbrzQ7ITky18CJtXweQN

    Score
    10/10
    defense_evasiondiscoverymacroxlm

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks