General
-
Target
872850569deb50974bbe0dd7a88af671_JaffaCakes118
-
Size
172KB
-
Sample
240531-qp9lpaab5y
-
MD5
872850569deb50974bbe0dd7a88af671
-
SHA1
1d45106bd3c96e9f8bfc35f9d5f678ba5806d38d
-
SHA256
f85dfa1d9e8cb5302ee601da7d5aabab444c6fbd52ac3d5f4cd30fa62bd5ecbb
-
SHA512
7d564fe22d5e5cfb9d35cd2c40f4210d1c9c085bb042b7c730b5862d94dd555e8b503650c40297d32c959d8aafe0cef3d845307465de698220a7a0a6f51c565f
-
SSDEEP
1536:erdi1Ir77zOH98Wj2gpngR+a9DpxO8nq78ct2PU7MXKSSxH5pcKaJn+7y29:erfrzOH98ipgGkB+7l
Behavioral task
behavioral1
Sample
872850569deb50974bbe0dd7a88af671_JaffaCakes118.doc
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
872850569deb50974bbe0dd7a88af671_JaffaCakes118.doc
Resource
win10v2004-20240426-en
Malware Config
Extracted
http://rhyton-building.com/wp-admin/Ey8qV0/
http://ezzll.com/wp-includes/KIU2WU/
http://tellmetech.com/wp-content/4ka/
https://elmundodelareposteria.com/wp-admin/0PVVmJm/
https://manuelrozas.cl/assets/XWN/
https://haritdharni.com/wp-admin/bZM/
https://theworks-group.com/site/pQT6j5/
Targets
-
-
Target
872850569deb50974bbe0dd7a88af671_JaffaCakes118
-
Size
172KB
-
MD5
872850569deb50974bbe0dd7a88af671
-
SHA1
1d45106bd3c96e9f8bfc35f9d5f678ba5806d38d
-
SHA256
f85dfa1d9e8cb5302ee601da7d5aabab444c6fbd52ac3d5f4cd30fa62bd5ecbb
-
SHA512
7d564fe22d5e5cfb9d35cd2c40f4210d1c9c085bb042b7c730b5862d94dd555e8b503650c40297d32c959d8aafe0cef3d845307465de698220a7a0a6f51c565f
-
SSDEEP
1536:erdi1Ir77zOH98Wj2gpngR+a9DpxO8nq78ct2PU7MXKSSxH5pcKaJn+7y29:erfrzOH98ipgGkB+7l
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-