Overview

overview

8

Static

static

3

08f4ed0f7e...18.exe

windows7-x64

8

08f4ed0f7e...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    08f4ed0f7ea07f4f029d94d2c4bf32e3_JaffaCakes118

  • Size

    3.3MB

  • Sample

    240430-ed5b2sbe69

  • MD5

    08f4ed0f7ea07f4f029d94d2c4bf32e3

  • SHA1

    ba11e30b0074b893fb2d919090c0436ba415d2d2

  • SHA256

    c1841d513618e6b6d8bb116e046de68154c38e9492f93614837ccd56a91e938d

  • SHA512

    c0d0a89265f027188e2948dc1663bb2ed2178236d94facba88ee7fd5f4618c42185ace2af0ba0f666330d8f6411eff0e0f7307c37772350818a5d6045e14505d

  • SSDEEP

    49152:NZT0tqsBOiRKkif7durHPiRKk9zbFwih/EiRKkif7durHPiRKkK:NatrB7Ruf7lRJz2qRuf7lRu

Score
8/10
persistence

Malware Config

Targets

    • Target

      08f4ed0f7ea07f4f029d94d2c4bf32e3_JaffaCakes118

    • Size

      3.3MB

    • MD5

      08f4ed0f7ea07f4f029d94d2c4bf32e3

    • SHA1

      ba11e30b0074b893fb2d919090c0436ba415d2d2

    • SHA256

      c1841d513618e6b6d8bb116e046de68154c38e9492f93614837ccd56a91e938d

    • SHA512

      c0d0a89265f027188e2948dc1663bb2ed2178236d94facba88ee7fd5f4618c42185ace2af0ba0f666330d8f6411eff0e0f7307c37772350818a5d6045e14505d

    • SSDEEP

      49152:NZT0tqsBOiRKkif7durHPiRKk9zbFwih/EiRKkif7durHPiRKkK:NatrB7Ruf7lRJz2qRuf7lRu

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks