General
-
Target
848d7cf8bff8a9ec91ae38b889ba36c5_JaffaCakes118
-
Size
151KB
-
Sample
240530-sapzvadd38
-
MD5
848d7cf8bff8a9ec91ae38b889ba36c5
-
SHA1
0a6922bad795d02c0c6cabc082f5ebc777e07a6c
-
SHA256
0c31f7d06ed4d36cc7a675ca0d3b92c5740d3ed73be44f19bea8b3d7c5f755ed
-
SHA512
30e9fe5ef83fea81527c1b8a77b28b4c039708c7debd91b62aefa0855d6fb1e44c7fcd733a78a4fb7bd0e3fd8a31fd910d9e0adf4dfe7fda908190e78b852c1d
-
SSDEEP
1536:sgtIgPgtIgxrdi1Ir77zOH98Wj2gpngR+a9urqYzE4gLUPxzwf:irfrzOH98ipgUqYzE41xzwf
Behavioral task
behavioral1
Sample
848d7cf8bff8a9ec91ae38b889ba36c5_JaffaCakes118.doc
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
848d7cf8bff8a9ec91ae38b889ba36c5_JaffaCakes118.doc
Resource
win10v2004-20240426-en
Malware Config
Extracted
http://www.gozowindmill.com/meteo/97/
http://www.greaudstudio.com/docs/Z/
https://b176f.cn/wp-admin/1/
https://blog.socialpill.in/jdzetd/fZuInax/
http://maisshake.com.br/wp-includes/dPmzV1/
http://mesdelicesitaliens.fr/wp-admin/tSlCBpP/
http://grndl.com/oinj/j4/
Targets
-
-
Target
848d7cf8bff8a9ec91ae38b889ba36c5_JaffaCakes118
-
Size
151KB
-
MD5
848d7cf8bff8a9ec91ae38b889ba36c5
-
SHA1
0a6922bad795d02c0c6cabc082f5ebc777e07a6c
-
SHA256
0c31f7d06ed4d36cc7a675ca0d3b92c5740d3ed73be44f19bea8b3d7c5f755ed
-
SHA512
30e9fe5ef83fea81527c1b8a77b28b4c039708c7debd91b62aefa0855d6fb1e44c7fcd733a78a4fb7bd0e3fd8a31fd910d9e0adf4dfe7fda908190e78b852c1d
-
SSDEEP
1536:sgtIgPgtIgxrdi1Ir77zOH98Wj2gpngR+a9urqYzE4gLUPxzwf:irfrzOH98ipgUqYzE41xzwf
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-