Overview

overview

10

Static

static

3

5010bb2afd...18.exe

windows7-x64

10

5010bb2afd...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5010bb2afd77b5f8212350a0c1369c5f_JaffaCakes118

  • Size

    830KB

  • Sample

    240517-r6qetace4y

  • MD5

    5010bb2afd77b5f8212350a0c1369c5f

  • SHA1

    1bc8a2816b8cec929e4dd627176e7a62d5e42ff4

  • SHA256

    673c9589154e4a752d129509e3d478e5e54087cb6b08d6200bd6c45ed0b339df

  • SHA512

    523dbfd68b82408cc5ee8f35d7d78729a836c5f6eeb716dea525310c10fff16657fc7b998cd0e8a331e58b1def36519d6a9ebafb9bc2915899825e911ed6388d

  • SSDEEP

    12288:UZWtI6RkgYeZJys73dOvXDpNjNe8Nu9OWYeZJys73dOvXDpNjNe8NuFOB0H:UuhaJeZJ8NI8feZJ8NI8uOM

Score
10/10
evasionexecutionpersistence

Malware Config

Targets

    • Target

      5010bb2afd77b5f8212350a0c1369c5f_JaffaCakes118

    • Size

      830KB

    • MD5

      5010bb2afd77b5f8212350a0c1369c5f

    • SHA1

      1bc8a2816b8cec929e4dd627176e7a62d5e42ff4

    • SHA256

      673c9589154e4a752d129509e3d478e5e54087cb6b08d6200bd6c45ed0b339df

    • SHA512

      523dbfd68b82408cc5ee8f35d7d78729a836c5f6eeb716dea525310c10fff16657fc7b998cd0e8a331e58b1def36519d6a9ebafb9bc2915899825e911ed6388d

    • SSDEEP

      12288:UZWtI6RkgYeZJys73dOvXDpNjNe8Nu9OWYeZJys73dOvXDpNjNe8NuFOB0H:UuhaJeZJ8NI8feZJ8NI8uOM

    Score
    10/10
    evasionexecutionpersistence

    • Disables service(s)

      evasionexecution

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks