Overview

overview

10

Static

static

8

JaffaCakes...bf.doc

windows10-2004-x64

10

JaffaCakes...bf.doc

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    JaffaCakes118_06e15310c1eb1465c990908a394613bf

  • Size

    158KB

  • Sample

    250519-d1hwwssks9

  • MD5

    06e15310c1eb1465c990908a394613bf

  • SHA1

    04ff9423021bc078f543b7b3ed6876f6337a7481

  • SHA256

    d0e3b3e28fb9cf4cb84c946ba315eee5cf8235a2bdadcadb3d1208efc7b65799

  • SHA512

    62deda70a4a92aecb0a2b09fa62828c54c11224547db40f6910939069c80ccd9812ef43cbba436f07784f4799715a7c16cf9f9e8a9844e647cf17ca34da80a18

  • SSDEEP

    3072:EX9ufstRUUKSns8T00JSHUgteMJ8qMD7gNltn:69ufsfgIf0pLN3n

Score
10/10
executionmacro

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://remediis.com/t/gm2X/
exe.dropper

http://avadnansahin.com/wp-includes/w/
exe.dropper

http://solicon.us/allam-cycle-1c4gn/f5z/
exe.dropper

http://www.riparazioni-radiotv.com/softaculous/DZz/
exe.dropper

http://www.agricampeggiocortecomotto.it/wp-admin/s7p1/
exe.dropper

https://www.starlingtechs.com/GNM/
exe.dropper

http://hellas-darmstadt.de/cgi-bin/ZSoo/

Targets

    • Target

      JaffaCakes118_06e15310c1eb1465c990908a394613bf

    • Size

      158KB

    • MD5

      06e15310c1eb1465c990908a394613bf

    • SHA1

      04ff9423021bc078f543b7b3ed6876f6337a7481

    • SHA256

      d0e3b3e28fb9cf4cb84c946ba315eee5cf8235a2bdadcadb3d1208efc7b65799

    • SHA512

      62deda70a4a92aecb0a2b09fa62828c54c11224547db40f6910939069c80ccd9812ef43cbba436f07784f4799715a7c16cf9f9e8a9844e647cf17ca34da80a18

    • SSDEEP

      3072:EX9ufstRUUKSns8T00JSHUgteMJ8qMD7gNltn:69ufsfgIf0pLN3n

    Score
    10/10
    execution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks