Overview

overview

8

Static

static

3

f1b5b6cb53...18.exe

windows7-x64

8

f1b5b6cb53...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f1b5b6cb53076e23c387743a5e75c5ad_JaffaCakes118

  • Size

    602KB

  • Sample

    240415-xsh2gaga2v

  • MD5

    f1b5b6cb53076e23c387743a5e75c5ad

  • SHA1

    08815abb077d98af8c83526ad58fa09a33956ba3

  • SHA256

    3d3cb28adbf4ef03bf8dcff05f70ef6e95849eaafcb9a6ab4691f9b439d194ea

  • SHA512

    21215c25d95e6f9a918e9791608c8aedb76873c10a7d3ef530be0f774fc606cf2c1de27d5b54b08f067b8bf0627848bf8a2bcbc44cf4c52fc9f2b10159a45fd0

  • SSDEEP

    12288:cnepKaV9OaW0FjM7rxUpwEiAfKzG5dliFuJ2lkrdcakCoDL4+gt:MS/f7FjOrxkwEiGliFPl4taDL4+

Score
8/10
persistence

Malware Config

Targets

    • Target

      f1b5b6cb53076e23c387743a5e75c5ad_JaffaCakes118

    • Size

      602KB

    • MD5

      f1b5b6cb53076e23c387743a5e75c5ad

    • SHA1

      08815abb077d98af8c83526ad58fa09a33956ba3

    • SHA256

      3d3cb28adbf4ef03bf8dcff05f70ef6e95849eaafcb9a6ab4691f9b439d194ea

    • SHA512

      21215c25d95e6f9a918e9791608c8aedb76873c10a7d3ef530be0f774fc606cf2c1de27d5b54b08f067b8bf0627848bf8a2bcbc44cf4c52fc9f2b10159a45fd0

    • SSDEEP

      12288:cnepKaV9OaW0FjM7rxUpwEiAfKzG5dliFuJ2lkrdcakCoDL4+gt:MS/f7FjOrxkwEiGliFPl4taDL4+

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Modifies AppInit DLL entries

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks