a493a5e0a1e26183b941d27156046b06c60e8dc8f8f4faf8c38edc7fc869e51a

General

Target

697339e5bc71f1314897402f124a351e_JaffaCakes118
Size

185KB
Sample

240523-cyxftsaf3v
MD5

697339e5bc71f1314897402f124a351e
SHA1

8c8d9015ac8f94eb4d069a5d3e5891fac75e19bf
SHA256

a493a5e0a1e26183b941d27156046b06c60e8dc8f8f4faf8c38edc7fc869e51a
SHA512

78081e45196a3185d82bfb10a64a50e3ac50056cd8b54f4ea0d8700a605a710f084a50f5608d23197142ee2ba3aa4cfc299174dba97a3a44ac4f11f11a91fbe8
SSDEEP

1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9fXljh:A4tcTvjvTY140818tIP4ovpW1jnGPs

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://loungegangnam.com/4W/dz/

exe.dropper

http://indyoverheaddoors.com/wp-includes/pZ/

exe.dropper

http://geoffoglemusic.com/wp-admin/w/

exe.dropper

http://giral2.com/wp-includes/0e/

exe.dropper

https://www.lunalysis.com/wordpress/syb/

exe.dropper

http://farli.com/cgi-bin/jK/

exe.dropper

http://goldcoastoffice365.com/temp/wQ/

Targets

- Target
  
  697339e5bc71f1314897402f124a351e_JaffaCakes118
- Size
  
  185KB
- MD5
  
  697339e5bc71f1314897402f124a351e
- SHA1
  
  8c8d9015ac8f94eb4d069a5d3e5891fac75e19bf
- SHA256
  
  a493a5e0a1e26183b941d27156046b06c60e8dc8f8f4faf8c38edc7fc869e51a
- SHA512
  
  78081e45196a3185d82bfb10a64a50e3ac50056cd8b54f4ea0d8700a605a710f084a50f5608d23197142ee2ba3aa4cfc299174dba97a3a44ac4f11f11a91fbe8
- SSDEEP
  
  1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9fXljh:A4tcTvjvTY140818tIP4ovpW1jnGPs
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2