General

  • Target

    848d7cf8bff8a9ec91ae38b889ba36c5_JaffaCakes118

  • Size

    151KB

  • Sample

    240530-sapzvadd38

  • MD5

    848d7cf8bff8a9ec91ae38b889ba36c5

  • SHA1

    0a6922bad795d02c0c6cabc082f5ebc777e07a6c

  • SHA256

    0c31f7d06ed4d36cc7a675ca0d3b92c5740d3ed73be44f19bea8b3d7c5f755ed

  • SHA512

    30e9fe5ef83fea81527c1b8a77b28b4c039708c7debd91b62aefa0855d6fb1e44c7fcd733a78a4fb7bd0e3fd8a31fd910d9e0adf4dfe7fda908190e78b852c1d

  • SSDEEP

    1536:sgtIgPgtIgxrdi1Ir77zOH98Wj2gpngR+a9urqYzE4gLUPxzwf:irfrzOH98ipgUqYzE41xzwf

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.gozowindmill.com/meteo/97/

exe.dropper

http://www.greaudstudio.com/docs/Z/

exe.dropper

https://b176f.cn/wp-admin/1/

exe.dropper

https://blog.socialpill.in/jdzetd/fZuInax/

exe.dropper

http://maisshake.com.br/wp-includes/dPmzV1/

exe.dropper

http://mesdelicesitaliens.fr/wp-admin/tSlCBpP/

exe.dropper

http://grndl.com/oinj/j4/

Targets

    • Target

      848d7cf8bff8a9ec91ae38b889ba36c5_JaffaCakes118

    • Size

      151KB

    • MD5

      848d7cf8bff8a9ec91ae38b889ba36c5

    • SHA1

      0a6922bad795d02c0c6cabc082f5ebc777e07a6c

    • SHA256

      0c31f7d06ed4d36cc7a675ca0d3b92c5740d3ed73be44f19bea8b3d7c5f755ed

    • SHA512

      30e9fe5ef83fea81527c1b8a77b28b4c039708c7debd91b62aefa0855d6fb1e44c7fcd733a78a4fb7bd0e3fd8a31fd910d9e0adf4dfe7fda908190e78b852c1d

    • SSDEEP

      1536:sgtIgPgtIgxrdi1Ir77zOH98Wj2gpngR+a9urqYzE4gLUPxzwf:irfrzOH98ipgUqYzE41xzwf

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks