Overview

overview

10

Static

static

1

edb75a3c81...18.doc

windows7-x64

10

edb75a3c81...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edb75a3c81b7b730bafa51164447f67d_JaffaCakes118

  • Size

    152KB

  • Sample

    240920-q192layhqc

  • MD5

    edb75a3c81b7b730bafa51164447f67d

  • SHA1

    d394994640ac3f37f7dbe1150c4cb91d97c85660

  • SHA256

    9530d202be6692b15721f936a6cd20a7319a5dc92e97e12b532ceb3d74641753

  • SHA512

    deb876f53633dbf6b2ec6def10d3ac5a6fa30b331ab0e3955d240fdc0ec3897f4f894bbad25bb8b444ae84534ec93db01f56ab37016a48afb3d777d5c1e6263c

  • SSDEEP

    1536:hAkT3yRFGEv0QtKPaOtMPAquK1gLadmpsHkkyeY+tB445TEgrO3jSWAg83tle1Zy:022TWTogk079THcpOu5UZ+7EuV

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.firhajshoes.com/wp-admin/RgaiT/
exe.dropper

http://fakeread.com/OneSignal-Web-SDK-HTTPS-Integration-Files/Wf/
exe.dropper

http://www.rttutoring.com/wp-includes/LlbY6o/
exe.dropper

http://blueskysol.com/sys-cache/2Rk/
exe.dropper

http://crazyboxs.com/cgi-bin/IaJ/
exe.dropper

http://www.paramedicaleducationguidelines.com/wp-admin/3jXU5Bp/
exe.dropper

http://nuhatoys.com/wp-admin/WWA4R/

Targets

    • Target

      edb75a3c81b7b730bafa51164447f67d_JaffaCakes118

    • Size

      152KB

    • MD5

      edb75a3c81b7b730bafa51164447f67d

    • SHA1

      d394994640ac3f37f7dbe1150c4cb91d97c85660

    • SHA256

      9530d202be6692b15721f936a6cd20a7319a5dc92e97e12b532ceb3d74641753

    • SHA512

      deb876f53633dbf6b2ec6def10d3ac5a6fa30b331ab0e3955d240fdc0ec3897f4f894bbad25bb8b444ae84534ec93db01f56ab37016a48afb3d777d5c1e6263c

    • SSDEEP

      1536:hAkT3yRFGEv0QtKPaOtMPAquK1gLadmpsHkkyeY+tB445TEgrO3jSWAg83tle1Zy:022TWTogk079THcpOu5UZ+7EuV

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks