General

  • Target

    872850569deb50974bbe0dd7a88af671_JaffaCakes118

  • Size

    172KB

  • Sample

    240531-qp9lpaab5y

  • MD5

    872850569deb50974bbe0dd7a88af671

  • SHA1

    1d45106bd3c96e9f8bfc35f9d5f678ba5806d38d

  • SHA256

    f85dfa1d9e8cb5302ee601da7d5aabab444c6fbd52ac3d5f4cd30fa62bd5ecbb

  • SHA512

    7d564fe22d5e5cfb9d35cd2c40f4210d1c9c085bb042b7c730b5862d94dd555e8b503650c40297d32c959d8aafe0cef3d845307465de698220a7a0a6f51c565f

  • SSDEEP

    1536:erdi1Ir77zOH98Wj2gpngR+a9DpxO8nq78ct2PU7MXKSSxH5pcKaJn+7y29:erfrzOH98ipgGkB+7l

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://rhyton-building.com/wp-admin/Ey8qV0/

exe.dropper

http://ezzll.com/wp-includes/KIU2WU/

exe.dropper

http://tellmetech.com/wp-content/4ka/

exe.dropper

https://elmundodelareposteria.com/wp-admin/0PVVmJm/

exe.dropper

https://manuelrozas.cl/assets/XWN/

exe.dropper

https://haritdharni.com/wp-admin/bZM/

exe.dropper

https://theworks-group.com/site/pQT6j5/

Targets

    • Target

      872850569deb50974bbe0dd7a88af671_JaffaCakes118

    • Size

      172KB

    • MD5

      872850569deb50974bbe0dd7a88af671

    • SHA1

      1d45106bd3c96e9f8bfc35f9d5f678ba5806d38d

    • SHA256

      f85dfa1d9e8cb5302ee601da7d5aabab444c6fbd52ac3d5f4cd30fa62bd5ecbb

    • SHA512

      7d564fe22d5e5cfb9d35cd2c40f4210d1c9c085bb042b7c730b5862d94dd555e8b503650c40297d32c959d8aafe0cef3d845307465de698220a7a0a6f51c565f

    • SSDEEP

      1536:erdi1Ir77zOH98Wj2gpngR+a9DpxO8nq78ct2PU7MXKSSxH5pcKaJn+7y29:erfrzOH98ipgGkB+7l

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks