General
- Target 69a741123d824a9b290ac9b210dcbd58_JaffaCakes118
- Size 247KB
- Sample240401-gpshqsfe97
- SHA256 1b9d6794f8df32779ea02105e8feff3a9308ac3a629a34097f65a915fe3a4184
- MD5 69a741123d824a9b290ac9b210dcbd58
- SHA1 64a8f6650ba99b1133ebd8e209c6eb0351a72a71
- SHA512 21a69daf7c88a7b6c77718473668296eed7a872a1ea9cb2427693f207e4eecfe88a0483ba4d9591a43a853f579117e566c2a59ea4ef0f8e59a3f1eb5b01e4265
- SSDEEP 6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7o:U9jFrjmkD7IvLDK3vLvfn1+2m
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
69a741123d824a9b290ac9b210dcbd58_JaffaCakes118.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69a741123d824a9b290ac9b210dcbd58_JaffaCakes118.xls
Resource
win10v2004-20240226-en
Malware Config
Extracted
-
xlm4.0
-
xlm40.dropper
https://samtnpy.org/bveCGKTX/ghb.html
-
xlm40.dropper
https://massngo.org/dXKvyKV9v8c/ghb.html
-
xlm40.dropper
https://vathiriyar.org/uy0Tk0keJUr/ghb.html
Extracted
-
xlm4.0
-
xlm40.dropper
https://samtnpy.org/bveCGKTX/ghb.html
-
xlm40.dropper
https://massngo.org/dXKvyKV9v8c/ghb.html
-
xlm40.dropper
https://vathiriyar.org/uy0Tk0keJUr/ghb.html
Targets
-
- Target 69a741123d824a9b290ac9b210dcbd58_JaffaCakes118
- Size 247KB
- SHA256 1b9d6794f8df32779ea02105e8feff3a9308ac3a629a34097f65a915fe3a4184
- MD5 69a741123d824a9b290ac9b210dcbd58
- SHA1 64a8f6650ba99b1133ebd8e209c6eb0351a72a71
- SHA512 21a69daf7c88a7b6c77718473668296eed7a872a1ea9cb2427693f207e4eecfe88a0483ba4d9591a43a853f579117e566c2a59ea4ef0f8e59a3f1eb5b01e4265
- SSDEEP 6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7o:U9jFrjmkD7IvLDK3vLvfn1+2m
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.