General
-
Target
01fd2c314257584d4265c6d20c59a497_JaffaCakes118
-
Size
186KB
-
Sample
240427-ams8xsfa58
-
MD5
01fd2c314257584d4265c6d20c59a497
-
SHA1
a3c863ef4bb0008dcdb60ac6793bd323d9ad71c8
-
SHA256
17c5546960d533b0df0defcf3c6a1db50d0ec10ebcdc9de157d9e40eb0c0d9f3
-
SHA512
6deca674233eee50aaecf127a3c9d4f01e9de96b4e4a0c113d6b2f424c0226ee6212d4bd462be63755008903cf57e750cd5af1d6f8cf2aeb4093af99bdafb433
-
SSDEEP
1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9BXljC:A4tcTvjvTY140818tIP4ovpQ1jnc8Ps
Behavioral task
behavioral1
Sample
01fd2c314257584d4265c6d20c59a497_JaffaCakes118.doc
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
01fd2c314257584d4265c6d20c59a497_JaffaCakes118.doc
Resource
win10v2004-20240419-en
Malware Config
Extracted
http://loungegangnam.com/4W/dz/
http://indyoverheaddoors.com/wp-includes/pZ/
http://geoffoglemusic.com/wp-admin/w/
http://giral2.com/wp-includes/0e/
https://www.lunalysis.com/wordpress/syb/
http://farli.com/cgi-bin/jK/
http://goldcoastoffice365.com/temp/wQ/
Targets
-
-
Target
01fd2c314257584d4265c6d20c59a497_JaffaCakes118
-
Size
186KB
-
MD5
01fd2c314257584d4265c6d20c59a497
-
SHA1
a3c863ef4bb0008dcdb60ac6793bd323d9ad71c8
-
SHA256
17c5546960d533b0df0defcf3c6a1db50d0ec10ebcdc9de157d9e40eb0c0d9f3
-
SHA512
6deca674233eee50aaecf127a3c9d4f01e9de96b4e4a0c113d6b2f424c0226ee6212d4bd462be63755008903cf57e750cd5af1d6f8cf2aeb4093af99bdafb433
-
SSDEEP
1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9BXljC:A4tcTvjvTY140818tIP4ovpQ1jnc8Ps
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-