General
-
Target
8520b96a379969c4a4a064764f4f7804_JaffaCakes118
-
Size
185KB
-
Sample
240530-2ff4kach89
-
MD5
8520b96a379969c4a4a064764f4f7804
-
SHA1
6103110e2c16e049de1240b9a025b86d4cf265cd
-
SHA256
0971fabef1b2be77896d3cad0f052c6fbe9486b64a4951ab6f0f5c1b2bb27680
-
SHA512
7cb021bb539fbf0583c321156c61b0fe24ddb280529c5eadfaa26684510958b003f97b8ea071a30af4e88d0208841624f168466c4d3214b433bfd43edb87351f
-
SSDEEP
1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9PXljz:A4tcTvjvTY140818tIP4ovpy1jnmPk
Behavioral task
behavioral1
Sample
8520b96a379969c4a4a064764f4f7804_JaffaCakes118.doc
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8520b96a379969c4a4a064764f4f7804_JaffaCakes118.doc
Resource
win10v2004-20240508-en
Malware Config
Extracted
http://loungegangnam.com/4W/dz/
http://indyoverheaddoors.com/wp-includes/pZ/
http://geoffoglemusic.com/wp-admin/w/
http://giral2.com/wp-includes/0e/
https://www.lunalysis.com/wordpress/syb/
http://farli.com/cgi-bin/jK/
http://goldcoastoffice365.com/temp/wQ/
Targets
-
-
Target
8520b96a379969c4a4a064764f4f7804_JaffaCakes118
-
Size
185KB
-
MD5
8520b96a379969c4a4a064764f4f7804
-
SHA1
6103110e2c16e049de1240b9a025b86d4cf265cd
-
SHA256
0971fabef1b2be77896d3cad0f052c6fbe9486b64a4951ab6f0f5c1b2bb27680
-
SHA512
7cb021bb539fbf0583c321156c61b0fe24ddb280529c5eadfaa26684510958b003f97b8ea071a30af4e88d0208841624f168466c4d3214b433bfd43edb87351f
-
SSDEEP
1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9PXljz:A4tcTvjvTY140818tIP4ovpy1jnmPk
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-