Overview

overview

10

Static

static

8

f4e7d953e0...18.doc

windows7-x64

10

f4e7d953e0...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4e7d953e025517305153b5c50afc0c3_JaffaCakes118

  • Size

    210KB

  • Sample

    240925-b7n1daxeqn

  • MD5

    f4e7d953e025517305153b5c50afc0c3

  • SHA1

    81b5499424735a0ab1f30c8ddd2ab52308119d63

  • SHA256

    f41df92a7bf31e22ac28e3e35cabf45f3be392f06c43b813eea05e2ca08f24bc

  • SHA512

    1a1b8660b2bc32cba99fbe803f542680715cc572bd57f4d3541710f982c9a074e970c5c7f9916789a364217da5ebb0a94ec5830b6ffeabd197bd536faec8e868

  • SSDEEP

    3072:0P22TWTogk079THcpOu5UZXN5kmcB/YNYsgU:E/TX07hHcJQZe0jj

Score
10/10
discoverymacro

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://waytoger.com/wp-admin/w/
exe.dropper

https://jaguarssus.xyz/wp-admin/GfU/
exe.dropper

https://learnkalmar.com/wp-includes/VSZ/
exe.dropper

http://tiendapablus.net/cgi-bin/SIr/
exe.dropper

https://prsaze.com/wp-admin/7a/
exe.dropper

https://www.campuscamarafp.com/wp-admin/N/
exe.dropper

https://infolockerz.com/wp-content/x/

Targets

    • Target

      f4e7d953e025517305153b5c50afc0c3_JaffaCakes118

    • Size

      210KB

    • MD5

      f4e7d953e025517305153b5c50afc0c3

    • SHA1

      81b5499424735a0ab1f30c8ddd2ab52308119d63

    • SHA256

      f41df92a7bf31e22ac28e3e35cabf45f3be392f06c43b813eea05e2ca08f24bc

    • SHA512

      1a1b8660b2bc32cba99fbe803f542680715cc572bd57f4d3541710f982c9a074e970c5c7f9916789a364217da5ebb0a94ec5830b6ffeabd197bd536faec8e868

    • SSDEEP

      3072:0P22TWTogk079THcpOu5UZXN5kmcB/YNYsgU:E/TX07hHcJQZe0jj

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks