General

  • Target

    0128f66536fbc02dd6d599e001fb159d_JaffaCakes118

  • Size

    162KB

  • Sample

    240727-1q2mkszhmn

  • MD5

    0128f66536fbc02dd6d599e001fb159d

  • SHA1

    7a66ad6be02f0daa9b453e370069c28fb98bf637

  • SHA256

    c8e79fc0288a89ec2d815e21d6d7f396bdbd52530a889df128b23b14a212f602

  • SHA512

    3f1ae8553c936ad4c440170950e0b5ef38a71985fe53b4dfec8b88c7ba07d2951efc366868c8306bb6f8fe4dbce63ec0b0c8a27b08b74a2f4d11afff8b862a94

  • SSDEEP

    1536:VxYAcBPFEiUSQH/P7HgOdPTQlmncksPsrbfPchzb8JRD3bNqfNpu39IId5a6XP30:PR1qf69xak3MgxC7/ZIb0X+RrMgo

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://transfersuvan.com/wp-admin/1J/

exe.dropper

http://da-industrial.com/js/aX/

exe.dropper

http://daprofesional.com/data4/aE/

exe.dropper

http://degepro.com/eTrac/px/

exe.dropper

http://hoagietesting10.com/wp-content/a/

exe.dropper

https://lifeadvicer.com/wp-content/FX/

exe.dropper

https://bangkokcityjewel.com/cgi-bin/F3/

Targets

    • Target

      0128f66536fbc02dd6d599e001fb159d_JaffaCakes118

    • Size

      162KB

    • MD5

      0128f66536fbc02dd6d599e001fb159d

    • SHA1

      7a66ad6be02f0daa9b453e370069c28fb98bf637

    • SHA256

      c8e79fc0288a89ec2d815e21d6d7f396bdbd52530a889df128b23b14a212f602

    • SHA512

      3f1ae8553c936ad4c440170950e0b5ef38a71985fe53b4dfec8b88c7ba07d2951efc366868c8306bb6f8fe4dbce63ec0b0c8a27b08b74a2f4d11afff8b862a94

    • SSDEEP

      1536:VxYAcBPFEiUSQH/P7HgOdPTQlmncksPsrbfPchzb8JRD3bNqfNpu39IId5a6XP30:PR1qf69xak3MgxC7/ZIb0X+RrMgo

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks