General
-
Target
4ba485cc258fc58f98c6988db67dd8cc_JaffaCakes118
-
Size
142KB
-
Sample
240715-17n3tasbnm
-
MD5
4ba485cc258fc58f98c6988db67dd8cc
-
SHA1
256c5c3fcd78a4021dc1e925ab236c06610be6da
-
SHA256
25b1663241f5c6f29c8107b961ae834d97668ec5017474e9092965197deb7017
-
SHA512
7f20bdd23ce66ef4ddc9020a55e554b8c3fbba52760f86b4076241511702c64a7e96497b282bf330d9278c83d73048efca94dc68729cb64bc97a0ef29f49fb62
-
SSDEEP
3072:GcPiTQAVW/89BQnmlcGvgZ6Gr3J8YUOMRt/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/9:GcPiTQAVW/89BQnmlcGvgZ7r3J8YUOM0
Behavioral task
behavioral1
Sample
4ba485cc258fc58f98c6988db67dd8cc_JaffaCakes118.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4ba485cc258fc58f98c6988db67dd8cc_JaffaCakes118.xls
Resource
win10v2004-20240709-en
Malware Config
Extracted
http://rzminc.com/xklyulyijvn/45488928957870400000.dat
http://pathinanchilearthmovers.com/eznwcdhx/45488928957870400000.dat
http://jugueterialatorre.com.ar/xjzpfwc/45488928957870400000.dat
http://rzminc.com/fdzgprclatqo/45488928957870400000.dat
http://biblicalisraeltours.com/otmchxmxeg/45488928957870400000.dat
Extracted
http://rzminc.com/xklyulyijvn/45488928985416700000.dat
http://pathinanchilearthmovers.com/eznwcdhx/45488928985416700000.dat
http://jugueterialatorre.com.ar/xjzpfwc/45488928985416700000.dat
http://rzminc.com/fdzgprclatqo/45488928985416700000.dat
http://biblicalisraeltours.com/otmchxmxeg/45488928985416700000.dat
Targets
-
-
Target
4ba485cc258fc58f98c6988db67dd8cc_JaffaCakes118
-
Size
142KB
-
MD5
4ba485cc258fc58f98c6988db67dd8cc
-
SHA1
256c5c3fcd78a4021dc1e925ab236c06610be6da
-
SHA256
25b1663241f5c6f29c8107b961ae834d97668ec5017474e9092965197deb7017
-
SHA512
7f20bdd23ce66ef4ddc9020a55e554b8c3fbba52760f86b4076241511702c64a7e96497b282bf330d9278c83d73048efca94dc68729cb64bc97a0ef29f49fb62
-
SSDEEP
3072:GcPiTQAVW/89BQnmlcGvgZ6Gr3J8YUOMRt/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/9:GcPiTQAVW/89BQnmlcGvgZ7r3J8YUOM0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-