Overview

overview

10

Static

static

3

01eea8198d...18.exe

windows7-x64

10

01eea8198d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01eea8198d32161d9d6cc45b3dfb3d60_JaffaCakes118

  • Size

    616KB

  • Sample

    240426-3ql81afd7v

  • MD5

    01eea8198d32161d9d6cc45b3dfb3d60

  • SHA1

    dbd821085591a448762c846baa27309d25a3d555

  • SHA256

    a8ca9cac699330b5be372383fdc7781a6ca042c09ec9fa1af287868ec041d4c6

  • SHA512

    4400471c63bbdfaeb564749255c026a4a5c08c79c30160801f94ed06ed367dbc85e9b5e7bc425a64af5976241a0a9be3c205f0a202ca8b5480c305539ee8ea58

  • SSDEEP

    12288:UZWtI6RkOeZJys73dOvXDpNjNe8TOB0vOB0H:UuhaOeZJ8NI8TOWOM

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      01eea8198d32161d9d6cc45b3dfb3d60_JaffaCakes118

    • Size

      616KB

    • MD5

      01eea8198d32161d9d6cc45b3dfb3d60

    • SHA1

      dbd821085591a448762c846baa27309d25a3d555

    • SHA256

      a8ca9cac699330b5be372383fdc7781a6ca042c09ec9fa1af287868ec041d4c6

    • SHA512

      4400471c63bbdfaeb564749255c026a4a5c08c79c30160801f94ed06ed367dbc85e9b5e7bc425a64af5976241a0a9be3c205f0a202ca8b5480c305539ee8ea58

    • SSDEEP

      12288:UZWtI6RkOeZJys73dOvXDpNjNe8TOB0vOB0H:UuhaOeZJ8NI8TOWOM

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks