General

  • Target

    0700ac042075e79083f6b5dbd99e2b77_JaffaCakes118

  • Size

    307KB

  • Sample

    240429-g2h5tscd76

  • MD5

    0700ac042075e79083f6b5dbd99e2b77

  • SHA1

    7131a53c7b9ecd1254468b13466b80d64f56de91

  • SHA256

    d8edaec331a06e54c0a7e7d51c52ed8909dae5eb4e774cf74032970c01d1de87

  • SHA512

    7e360f08dda712d452c1a3d21997c10b341919595348e0d519a03d31237fbaee61b64ba82bc6ffa1533bb0485644536681ee8c207acb667ab33d8ded5c883071

  • SSDEEP

    3072:fSTBCe6+NcSDZjgRtjvIOzdksMGA8zfI/oEQ9gjjRWjIkYqLjL/xSu90OoiLuDKm:f2N9IbIydQGAuYQGgjtzxUOmD+XfwL7

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://kurzal.ru/wordpress/wp-content/uploads/czt7YdTi3rZV_pa7

exe.dropper

http://labterpadu.ulm.ac.id/77gLl6H6qP

exe.dropper

http://duken.kz/SOHMlMvz

exe.dropper

http://compex-online.ru/1v3PpPJA6C

exe.dropper

http://marketingonline.vn/wp-admin/SojclY7Rslabm_423l6

Targets

    • Target

      0700ac042075e79083f6b5dbd99e2b77_JaffaCakes118

    • Size

      307KB

    • MD5

      0700ac042075e79083f6b5dbd99e2b77

    • SHA1

      7131a53c7b9ecd1254468b13466b80d64f56de91

    • SHA256

      d8edaec331a06e54c0a7e7d51c52ed8909dae5eb4e774cf74032970c01d1de87

    • SHA512

      7e360f08dda712d452c1a3d21997c10b341919595348e0d519a03d31237fbaee61b64ba82bc6ffa1533bb0485644536681ee8c207acb667ab33d8ded5c883071

    • SSDEEP

      3072:fSTBCe6+NcSDZjgRtjvIOzdksMGA8zfI/oEQ9gjjRWjIkYqLjL/xSu90OoiLuDKm:f2N9IbIydQGAuYQGgjtzxUOmD+XfwL7

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks