Overview

overview

10

Static

static

3

f85b93364a...18.exe

windows7-x64

10

f85b93364a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f85b93364a678d47d4b54675dda1abc3_JaffaCakes118

  • Size

    283KB

  • Sample

    240418-t2w3xaag6x

  • MD5

    f85b93364a678d47d4b54675dda1abc3

  • SHA1

    e03b6b4d0690d66e323868e1243b32e2af947b0a

  • SHA256

    42525e109fc534ac972d74fcb8c628528ddecc7c124ff1c0a5059139444f4165

  • SHA512

    97e78d70291383bfbfbef98617294dc1eb61a757ece1eb88aea5036d913c0731fc2247c061d0261fd4cfa97e344b94bce0b55c7878ea6d85222206fae31c96bf

  • SSDEEP

    6144:OKrLgPF8Q6JOI8WCjYd2XGSa/oZrUf0c/mH8M:OqkPaQ6JqVY2aAS1C8

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      f85b93364a678d47d4b54675dda1abc3_JaffaCakes118

    • Size

      283KB

    • MD5

      f85b93364a678d47d4b54675dda1abc3

    • SHA1

      e03b6b4d0690d66e323868e1243b32e2af947b0a

    • SHA256

      42525e109fc534ac972d74fcb8c628528ddecc7c124ff1c0a5059139444f4165

    • SHA512

      97e78d70291383bfbfbef98617294dc1eb61a757ece1eb88aea5036d913c0731fc2247c061d0261fd4cfa97e344b94bce0b55c7878ea6d85222206fae31c96bf

    • SSDEEP

      6144:OKrLgPF8Q6JOI8WCjYd2XGSa/oZrUf0c/mH8M:OqkPaQ6JqVY2aAS1C8

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks