Overview

overview

7

Static

static

3

fd3d2ff594...18.exe

windows7-x64

7

fd3d2ff594...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    fd3d2ff594a2d101d2717d2d4dd13b87_JaffaCakes118

  • Size

    179KB

  • Sample

    240420-vwqjlsea2s

  • MD5

    fd3d2ff594a2d101d2717d2d4dd13b87

  • SHA1

    acaa746bae0e848a7a3650b0f18a899621eb5f89

  • SHA256

    b4898ba6a8a51d566169ecaf43d587c97d8327bde71d5df81ff217db526f4010

  • SHA512

    337eecc029ff4c95ffbe446801126bc28cec514ceb0f48f753369c9ec64fdc88573b52491644d52fa8db76b48808a460ba928da17801e98dac39b6160b1ff758

  • SSDEEP

    3072:LPyAhp+3DCX4+8BQMocuz6UhJsUIo4pM+XdH9XvJNzW7U:Lqzzf9ocS60JsXzdHFvjz0U

Score
7/10
persistence

Malware Config

Targets

    • Target

      fd3d2ff594a2d101d2717d2d4dd13b87_JaffaCakes118

    • Size

      179KB

    • MD5

      fd3d2ff594a2d101d2717d2d4dd13b87

    • SHA1

      acaa746bae0e848a7a3650b0f18a899621eb5f89

    • SHA256

      b4898ba6a8a51d566169ecaf43d587c97d8327bde71d5df81ff217db526f4010

    • SHA512

      337eecc029ff4c95ffbe446801126bc28cec514ceb0f48f753369c9ec64fdc88573b52491644d52fa8db76b48808a460ba928da17801e98dac39b6160b1ff758

    • SSDEEP

      3072:LPyAhp+3DCX4+8BQMocuz6UhJsUIo4pM+XdH9XvJNzW7U:Lqzzf9ocS60JsXzdHFvjz0U

    Score
    7/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks