General
-
Target
0128f66536fbc02dd6d599e001fb159d_JaffaCakes118
-
Size
162KB
-
Sample
240727-1q2mkszhmn
-
MD5
0128f66536fbc02dd6d599e001fb159d
-
SHA1
7a66ad6be02f0daa9b453e370069c28fb98bf637
-
SHA256
c8e79fc0288a89ec2d815e21d6d7f396bdbd52530a889df128b23b14a212f602
-
SHA512
3f1ae8553c936ad4c440170950e0b5ef38a71985fe53b4dfec8b88c7ba07d2951efc366868c8306bb6f8fe4dbce63ec0b0c8a27b08b74a2f4d11afff8b862a94
-
SSDEEP
1536:VxYAcBPFEiUSQH/P7HgOdPTQlmncksPsrbfPchzb8JRD3bNqfNpu39IId5a6XP30:PR1qf69xak3MgxC7/ZIb0X+RrMgo
Static task
static1
Behavioral task
behavioral1
Sample
0128f66536fbc02dd6d599e001fb159d_JaffaCakes118.doc
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0128f66536fbc02dd6d599e001fb159d_JaffaCakes118.doc
Resource
win10v2004-20240709-en
Malware Config
Extracted
http://transfersuvan.com/wp-admin/1J/
http://da-industrial.com/js/aX/
http://daprofesional.com/data4/aE/
http://degepro.com/eTrac/px/
http://hoagietesting10.com/wp-content/a/
https://lifeadvicer.com/wp-content/FX/
https://bangkokcityjewel.com/cgi-bin/F3/
Targets
-
-
Target
0128f66536fbc02dd6d599e001fb159d_JaffaCakes118
-
Size
162KB
-
MD5
0128f66536fbc02dd6d599e001fb159d
-
SHA1
7a66ad6be02f0daa9b453e370069c28fb98bf637
-
SHA256
c8e79fc0288a89ec2d815e21d6d7f396bdbd52530a889df128b23b14a212f602
-
SHA512
3f1ae8553c936ad4c440170950e0b5ef38a71985fe53b4dfec8b88c7ba07d2951efc366868c8306bb6f8fe4dbce63ec0b0c8a27b08b74a2f4d11afff8b862a94
-
SSDEEP
1536:VxYAcBPFEiUSQH/P7HgOdPTQlmncksPsrbfPchzb8JRD3bNqfNpu39IId5a6XP30:PR1qf69xak3MgxC7/ZIb0X+RrMgo
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-