General

  • Target

    8520b96a379969c4a4a064764f4f7804_JaffaCakes118

  • Size

    185KB

  • Sample

    240530-2ff4kach89

  • MD5

    8520b96a379969c4a4a064764f4f7804

  • SHA1

    6103110e2c16e049de1240b9a025b86d4cf265cd

  • SHA256

    0971fabef1b2be77896d3cad0f052c6fbe9486b64a4951ab6f0f5c1b2bb27680

  • SHA512

    7cb021bb539fbf0583c321156c61b0fe24ddb280529c5eadfaa26684510958b003f97b8ea071a30af4e88d0208841624f168466c4d3214b433bfd43edb87351f

  • SSDEEP

    1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9PXljz:A4tcTvjvTY140818tIP4ovpy1jnmPk

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://loungegangnam.com/4W/dz/

exe.dropper

http://indyoverheaddoors.com/wp-includes/pZ/

exe.dropper

http://geoffoglemusic.com/wp-admin/w/

exe.dropper

http://giral2.com/wp-includes/0e/

exe.dropper

https://www.lunalysis.com/wordpress/syb/

exe.dropper

http://farli.com/cgi-bin/jK/

exe.dropper

http://goldcoastoffice365.com/temp/wQ/

Targets

    • Target

      8520b96a379969c4a4a064764f4f7804_JaffaCakes118

    • Size

      185KB

    • MD5

      8520b96a379969c4a4a064764f4f7804

    • SHA1

      6103110e2c16e049de1240b9a025b86d4cf265cd

    • SHA256

      0971fabef1b2be77896d3cad0f052c6fbe9486b64a4951ab6f0f5c1b2bb27680

    • SHA512

      7cb021bb539fbf0583c321156c61b0fe24ddb280529c5eadfaa26684510958b003f97b8ea071a30af4e88d0208841624f168466c4d3214b433bfd43edb87351f

    • SSDEEP

      1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9PXljz:A4tcTvjvTY140818tIP4ovpy1jnmPk

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks