Overview

overview

8

Static

static

3

f6fc33d785...18.exe

windows7-x64

8

f6fc33d785...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6fc33d78500122206be99a7a01995a3_JaffaCakes118

  • Size

    250KB

  • Sample

    240418-bqbzgsfa27

  • MD5

    f6fc33d78500122206be99a7a01995a3

  • SHA1

    d75c269fea5e64e347236ccd403944c5f8e730bf

  • SHA256

    34350f98e5d792b9c822833127f6fc464f62225f960b27e9732cc033c0d22592

  • SHA512

    26968feec0ed412af72705494fc0d89097cc9945f78f6f3ade8fd1636251d6f006e76a67b32f52ddc7c21c7b52c6510d8931c373fff5d3668d1c59cbf783bd9b

  • SSDEEP

    6144:JZt5xZt53Zt53Zt5xZt53Zt53Zt53Zt53Zt5/:Jrttrttttd

Score
8/10
persistence

Malware Config

Targets

    • Target

      f6fc33d78500122206be99a7a01995a3_JaffaCakes118

    • Size

      250KB

    • MD5

      f6fc33d78500122206be99a7a01995a3

    • SHA1

      d75c269fea5e64e347236ccd403944c5f8e730bf

    • SHA256

      34350f98e5d792b9c822833127f6fc464f62225f960b27e9732cc033c0d22592

    • SHA512

      26968feec0ed412af72705494fc0d89097cc9945f78f6f3ade8fd1636251d6f006e76a67b32f52ddc7c21c7b52c6510d8931c373fff5d3668d1c59cbf783bd9b

    • SSDEEP

      6144:JZt5xZt53Zt53Zt5xZt53Zt53Zt53Zt53Zt5/:Jrttrttttd

    Score
    8/10
    persistence

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks