Overview

overview

10

Static

static

1

f61ac9be96...18.doc

windows7-x64

10

f61ac9be96...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f61ac9be9645ff1dae1fb13c750634aa_JaffaCakes118

  • Size

    197KB

  • Sample

    240925-qma1ca1bma

  • MD5

    f61ac9be9645ff1dae1fb13c750634aa

  • SHA1

    f2b07466fd8e7ed2cb004df50ba1cdcf016319a5

  • SHA256

    72b9920e61919b7fc85e4427fa0bcad4d660a87904174a9f3bc2c7ae664ef434

  • SHA512

    18e6fe6f32fa17ef735b98dca1a69b55f493bcde1b8479d7bc42b5a6c718ad8b862ad58fcdfc53475c506e4042a2c9a285862abd53389056d81c594d7fcbe9c7

  • SSDEEP

    3072:It9ufstRUUKSns8T00JSHUgteMJ8qMD7gRQcwR0PK2zkm:It9ufsfgIf0pLHwRAYm

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://fulfillmententertainment.com/cgi-bin/WrD/
exe.dropper

https://www.getwayimmigration.com/vqg1j3/1BwbZNN/
exe.dropper

http://vidadohomem.com/wp-content/O2ir3vx/
exe.dropper

http://analyticscosm.com/cgi-bin/PwlMy/
exe.dropper

http://www.angiathinh.com/wp-admin/KpNfK/
exe.dropper

http://twoparrot.com/wp-includes/s7aGv/
exe.dropper

http://ieee-acts.com/mainpage/vG/

Targets

    • Target

      f61ac9be9645ff1dae1fb13c750634aa_JaffaCakes118

    • Size

      197KB

    • MD5

      f61ac9be9645ff1dae1fb13c750634aa

    • SHA1

      f2b07466fd8e7ed2cb004df50ba1cdcf016319a5

    • SHA256

      72b9920e61919b7fc85e4427fa0bcad4d660a87904174a9f3bc2c7ae664ef434

    • SHA512

      18e6fe6f32fa17ef735b98dca1a69b55f493bcde1b8479d7bc42b5a6c718ad8b862ad58fcdfc53475c506e4042a2c9a285862abd53389056d81c594d7fcbe9c7

    • SSDEEP

      3072:It9ufstRUUKSns8T00JSHUgteMJ8qMD7gRQcwR0PK2zkm:It9ufsfgIf0pLHwRAYm

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks