33bab5da95407fde0ab439aa5942622a7e1286cb5ad74d4e55689fa5c59f8559

General

Target

2ff53c10a0d9f280aaa172284df6bed0_JaffaCakes118
Size

195KB
Sample

240510-tm918ahd57
MD5

2ff53c10a0d9f280aaa172284df6bed0
SHA1

3cd3a1a3c266acd3e139ad0e9afc623061b0c0dd
SHA256

33bab5da95407fde0ab439aa5942622a7e1286cb5ad74d4e55689fa5c59f8559
SHA512

17b0283e2bafb97dbaa5934cfc2620d56eb8f0c6acb0f24b709c904295d8783e84db55273281322a55889f79b14cd0a579d095f8037f29eeced2766609011dfd
SSDEEP

1536:2rdi1Ir77zOH98Wj2gpngh+a9vEul8oPhEPmRl6VOo4p:2rfrzOH98ipgzEul8uWP+l6VOo4p

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://vstbar.com/wp-admin/Hs/

exe.dropper

http://binarywebtechsolutions.com/mobile-website-designing-company-in-gurgaon/CLZ/

exe.dropper

http://shahqutubuddin.org/U/

exe.dropper

http://cybersign-001-site5.gtempurl.com/2xwzq/bve/

exe.dropper

https://star-speed.vip/wp-admin/Ttv/

exe.dropper

https://treneg.com.br/rfvmbh/a/

exe.dropper

https://cimsjr.com/hospital/x2f/

Targets

- Target
  
  2ff53c10a0d9f280aaa172284df6bed0_JaffaCakes118
- Size
  
  195KB
- MD5
  
  2ff53c10a0d9f280aaa172284df6bed0
- SHA1
  
  3cd3a1a3c266acd3e139ad0e9afc623061b0c0dd
- SHA256
  
  33bab5da95407fde0ab439aa5942622a7e1286cb5ad74d4e55689fa5c59f8559
- SHA512
  
  17b0283e2bafb97dbaa5934cfc2620d56eb8f0c6acb0f24b709c904295d8783e84db55273281322a55889f79b14cd0a579d095f8037f29eeced2766609011dfd
- SSDEEP
  
  1536:2rdi1Ir77zOH98Wj2gpngh+a9vEul8oPhEPmRl6VOo4p:2rfrzOH98ipgzEul8uWP+l6VOo4p
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2