Overview

overview

10

Static

static

3

ed2002e9df...18.exe

windows7-x64

10

ed2002e9df...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ed2002e9dff772a172123eda8e404fe9_JaffaCakes118

  • Size

    491KB

  • Sample

    240411-lpf7xsgg83

  • MD5

    ed2002e9dff772a172123eda8e404fe9

  • SHA1

    39864e592ccd90e1064b66e3605cf4748313ffdf

  • SHA256

    fb4bcc828d7ce7340ec724a55a595f14d5471d5f20fc2981730597f76448fc96

  • SHA512

    3878a2c9e5ae226bb6525bc681e2491f45a3ddb226c6e3c890693077cefcd2bee41f5eb03700c86449ef3781943ebfad49c4eda1149090008123b80d4e79aec9

  • SSDEEP

    6144:UZfec9EbXDk6Rk8KJrG1VVE+Ih/UOPSe570Szp3Znmy+g4VrG1VVE+IwrG1VVE+t:UZWtI6RkbupOB06Kunut

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      ed2002e9dff772a172123eda8e404fe9_JaffaCakes118

    • Size

      491KB

    • MD5

      ed2002e9dff772a172123eda8e404fe9

    • SHA1

      39864e592ccd90e1064b66e3605cf4748313ffdf

    • SHA256

      fb4bcc828d7ce7340ec724a55a595f14d5471d5f20fc2981730597f76448fc96

    • SHA512

      3878a2c9e5ae226bb6525bc681e2491f45a3ddb226c6e3c890693077cefcd2bee41f5eb03700c86449ef3781943ebfad49c4eda1149090008123b80d4e79aec9

    • SSDEEP

      6144:UZfec9EbXDk6Rk8KJrG1VVE+Ih/UOPSe570Szp3Znmy+g4VrG1VVE+IwrG1VVE+t:UZWtI6RkbupOB06Kunut

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks