Overview

overview

10

Static

static

8

5fbf725f1f...18.doc

windows7-x64

10

5fbf725f1f...18.doc

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5fbf725f1f9b277fa7b96acf6e3e371b_JaffaCakes118

  • Size

    171KB

  • Sample

    240520-sjyckseh48

  • MD5

    5fbf725f1f9b277fa7b96acf6e3e371b

  • SHA1

    6eb4253454455877d5b56278111d160e72515d46

  • SHA256

    eda948b222a92d6413713f55234470c04b2433e2382638dcd362382b73dfcc8d

  • SHA512

    44fba2a6616e08877b8b990808aa30c73618b1ea77d63364196664336263a86d686296ff8a1aa25acce34854d2d3750c331d26f1673474d81146ce8852ef1e68

  • SSDEEP

    1536:erdi1Ir77zOH98Wj2gpngR+a9wtxO8nq78ct2PU7MXKSSxH5pcKaJnz7y2l:erfrzOH98ipgrkBz7N

Score
10/10
macro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://rhyton-building.com/wp-admin/Ey8qV0/
exe.dropper

http://ezzll.com/wp-includes/KIU2WU/
exe.dropper

http://tellmetech.com/wp-content/4ka/
exe.dropper

https://elmundodelareposteria.com/wp-admin/0PVVmJm/
exe.dropper

https://manuelrozas.cl/assets/XWN/
exe.dropper

https://haritdharni.com/wp-admin/bZM/
exe.dropper

https://theworks-group.com/site/pQT6j5/

Targets

    • Target

      5fbf725f1f9b277fa7b96acf6e3e371b_JaffaCakes118

    • Size

      171KB

    • MD5

      5fbf725f1f9b277fa7b96acf6e3e371b

    • SHA1

      6eb4253454455877d5b56278111d160e72515d46

    • SHA256

      eda948b222a92d6413713f55234470c04b2433e2382638dcd362382b73dfcc8d

    • SHA512

      44fba2a6616e08877b8b990808aa30c73618b1ea77d63364196664336263a86d686296ff8a1aa25acce34854d2d3750c331d26f1673474d81146ce8852ef1e68

    • SSDEEP

      1536:erdi1Ir77zOH98Wj2gpngR+a9wtxO8nq78ct2PU7MXKSSxH5pcKaJnz7y2l:erfrzOH98ipgrkBz7N

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks