Overview

overview

10

Static

static

1

fb31bb296b...18.doc

windows7-x64

10

fb31bb296b...18.doc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb31bb296bf3fb445eedb3a3b20c0ccb_JaffaCakes118

  • Size

    163KB

  • Sample

    240928-a341csxhpp

  • MD5

    fb31bb296bf3fb445eedb3a3b20c0ccb

  • SHA1

    bf4e7859d580343199ced54147fa57faf1c0a253

  • SHA256

    ace46d2110313599b081c85c401a092182633a33621e529365657305eac4c094

  • SHA512

    0ea212fc048c4c7c5cce74a513c7db334424c7648adf68b8a5a777da836a2fec9e58673a1132765807723c32c20109ca0fec4c94294d4b5367ffa6f6f80042ac

  • SSDEEP

    1536:KPB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5J+a9mluNGGdywlVe:KP22TWTogk079THcpOu5UZ0luNTdTVe

Score
10/10
discovery

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://vuatritue.com/wp-admin/w/
exe.dropper

http://castlestudios.com/bots/7/
exe.dropper

https://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/
exe.dropper

http://brandstrumpet-001-site1.ctempurl.com/default/lnD/
exe.dropper

http://oneinsix.com/test/u/
exe.dropper

http://livefarma.com/wp-content/hpu/
exe.dropper

http://datawyse.net/cgi-bin/8/

Targets

    • Target

      fb31bb296bf3fb445eedb3a3b20c0ccb_JaffaCakes118

    • Size

      163KB

    • MD5

      fb31bb296bf3fb445eedb3a3b20c0ccb

    • SHA1

      bf4e7859d580343199ced54147fa57faf1c0a253

    • SHA256

      ace46d2110313599b081c85c401a092182633a33621e529365657305eac4c094

    • SHA512

      0ea212fc048c4c7c5cce74a513c7db334424c7648adf68b8a5a777da836a2fec9e58673a1132765807723c32c20109ca0fec4c94294d4b5367ffa6f6f80042ac

    • SSDEEP

      1536:KPB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5J+a9mluNGGdywlVe:KP22TWTogk079THcpOu5UZ0luNTdTVe

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks