General

  • Target

    14bd5425c9d17b920e495b1baf4f3059_JaffaCakes118

  • Size

    136KB

  • Sample

    240504-2ax5wsdc5s

  • MD5

    14bd5425c9d17b920e495b1baf4f3059

  • SHA1

    5446e1997ccabefcbce49acb858a597f66c5a58a

  • SHA256

    5d385c2c68efcc13faac60153b025abf7d907d3812d96a6dbdadfa20dca9f13b

  • SHA512

    625a6b2782e7487cc47c02081ad56a18d67fcec5d1e3a1186414878298bfa64e454da79da23bac1155090f769693d356be4a600300d5c7ad113172a696a11959

  • SSDEEP

    3072:4cqKD9Qw5nfVJckx6foIKtGLwmCdvaktx3:RqKD9QsbmFKYLwmCdv/n

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://firemaplegames.com/6QszVr7G

exe.dropper

http://eventoursport.com/Lx6nMWd

exe.dropper

http://eikokomiya.com/eMsz5FoEK

exe.dropper

http://dzyne.net/4H4cM6YLj4

exe.dropper

http://doncartel.nl/DlSi8MT

Targets

    • Target

      14bd5425c9d17b920e495b1baf4f3059_JaffaCakes118

    • Size

      136KB

    • MD5

      14bd5425c9d17b920e495b1baf4f3059

    • SHA1

      5446e1997ccabefcbce49acb858a597f66c5a58a

    • SHA256

      5d385c2c68efcc13faac60153b025abf7d907d3812d96a6dbdadfa20dca9f13b

    • SHA512

      625a6b2782e7487cc47c02081ad56a18d67fcec5d1e3a1186414878298bfa64e454da79da23bac1155090f769693d356be4a600300d5c7ad113172a696a11959

    • SSDEEP

      3072:4cqKD9Qw5nfVJckx6foIKtGLwmCdvaktx3:RqKD9QsbmFKYLwmCdv/n

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks