General

  • Target

    ecc07f170e61717e1004f0898f8cec3e_JaffaCakes118

  • Size

    162KB

  • Sample

    240920-dzq6wawgqq

  • MD5

    ecc07f170e61717e1004f0898f8cec3e

  • SHA1

    4493f46e2ddbd7525a84bb722f62dd6e4312fd89

  • SHA256

    886c89c24607623a2d19bc97ea142d0ae166bce904aec28bd51c20871ac9cc72

  • SHA512

    c010f04233e5653bcf707ac06b6157cf64fcad656ffedd0c35d217679ad736d032809c8fa93e2c431856ab8877085b8cc2690c262aa15c504998815045f77e85

  • SSDEEP

    1536:VxYAcBPFEiUSQH/P7HgOdPTQlmncksPsrbfPchzb8JRD3bNqfNpu39IId5a6XP3M:PR1qf69xak3MgxCX/ZIb0X+RrMgY

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://transfersuvan.com/wp-admin/1J/

exe.dropper

http://da-industrial.com/js/aX/

exe.dropper

http://daprofesional.com/data4/aE/

exe.dropper

http://degepro.com/eTrac/px/

exe.dropper

http://hoagietesting10.com/wp-content/a/

exe.dropper

https://lifeadvicer.com/wp-content/FX/

exe.dropper

https://bangkokcityjewel.com/cgi-bin/F3/

Targets

    • Target

      ecc07f170e61717e1004f0898f8cec3e_JaffaCakes118

    • Size

      162KB

    • MD5

      ecc07f170e61717e1004f0898f8cec3e

    • SHA1

      4493f46e2ddbd7525a84bb722f62dd6e4312fd89

    • SHA256

      886c89c24607623a2d19bc97ea142d0ae166bce904aec28bd51c20871ac9cc72

    • SHA512

      c010f04233e5653bcf707ac06b6157cf64fcad656ffedd0c35d217679ad736d032809c8fa93e2c431856ab8877085b8cc2690c262aa15c504998815045f77e85

    • SSDEEP

      1536:VxYAcBPFEiUSQH/P7HgOdPTQlmncksPsrbfPchzb8JRD3bNqfNpu39IId5a6XP3M:PR1qf69xak3MgxCX/ZIb0X+RrMgY

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks