Overview

overview

10

Static

static

3

13101419a5...18.exe

windows7-x64

10

13101419a5...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13101419a5db90bd57f2a9ff445cb297_JaffaCakes118

  • Size

    322KB

  • Sample

    240504-rfpetsga5y

  • MD5

    13101419a5db90bd57f2a9ff445cb297

  • SHA1

    0439638d87cf8e82c61dc9d70b5b0d49f050dd63

  • SHA256

    6cc10cf0bc6a20d679f9b018049f5e4197a5c7f1264d7709178c7b8c57c4deb0

  • SHA512

    2b15ba1b4f64d1d69a1dc5f3f23d707105be4de411246f0063c7ce921da20e976a1f77be4f9697998179361af54b6cfd836683c51d0a187899574d4e8af38552

  • SSDEEP

    6144:MUJwFed/o/fn6mhoiN7KhKBN7wJbbCfP:MLg8f6Goo7gbE

Score
10/10
persistence

Malware Config

Targets

    • Target

      13101419a5db90bd57f2a9ff445cb297_JaffaCakes118

    • Size

      322KB

    • MD5

      13101419a5db90bd57f2a9ff445cb297

    • SHA1

      0439638d87cf8e82c61dc9d70b5b0d49f050dd63

    • SHA256

      6cc10cf0bc6a20d679f9b018049f5e4197a5c7f1264d7709178c7b8c57c4deb0

    • SHA512

      2b15ba1b4f64d1d69a1dc5f3f23d707105be4de411246f0063c7ce921da20e976a1f77be4f9697998179361af54b6cfd836683c51d0a187899574d4e8af38552

    • SSDEEP

      6144:MUJwFed/o/fn6mhoiN7KhKBN7wJbbCfP:MLg8f6Goo7gbE

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks