Overview

overview

10

Static

static

3

496e1c02fd...18.exe

windows7-x64

10

496e1c02fd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    496e1c02fdb685b18f22b85fe7f1d30b_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240516-e6c39scb2s

  • MD5

    496e1c02fdb685b18f22b85fe7f1d30b

  • SHA1

    ad5201f1f9ee77dbe7e4be0219f941793ba4c239

  • SHA256

    99c6823540d739466a9c1160b7d6e5fa38d500f121cad8a00987e01f2134fbdd

  • SHA512

    c28509f2faadb49ff0ccac5ce58781f0fc3d10f157312756956e1a81b1b162028268b0bcefc6b1e51862dbd75fec66c11832b9d45e86f0b79eadc5fcdc155b37

  • SSDEEP

    12288:UZWtI6Rkkt+Oht+Oht+Oht+Oht+Oht3CPZCA:Uuha7cA

Score
10/10
evasionexecutionpersistence

Malware Config

Targets

    • Target

      496e1c02fdb685b18f22b85fe7f1d30b_JaffaCakes118

    • Size

      1.5MB

    • MD5

      496e1c02fdb685b18f22b85fe7f1d30b

    • SHA1

      ad5201f1f9ee77dbe7e4be0219f941793ba4c239

    • SHA256

      99c6823540d739466a9c1160b7d6e5fa38d500f121cad8a00987e01f2134fbdd

    • SHA512

      c28509f2faadb49ff0ccac5ce58781f0fc3d10f157312756956e1a81b1b162028268b0bcefc6b1e51862dbd75fec66c11832b9d45e86f0b79eadc5fcdc155b37

    • SSDEEP

      12288:UZWtI6Rkkt+Oht+Oht+Oht+Oht+Oht3CPZCA:Uuha7cA

    Score
    10/10
    evasionexecutionpersistence

    • Disables service(s)

      evasionexecution

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks