Overview

overview

8

Static

static

3

686e197bc7...18.exe

windows7-x64

8

686e197bc7...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    686e197bc7c5e5b72e7388d36647ea2b_JaffaCakes118

  • Size

    45KB

  • Sample

    240522-ypq4caee53

  • MD5

    686e197bc7c5e5b72e7388d36647ea2b

  • SHA1

    db05caf45a8594fc3b624475348e54b4b73ee4b3

  • SHA256

    4d59602413c44feabdf6ed46cd420b174f800e4a1c795808ce24534d8ea6f4c5

  • SHA512

    3a9295ef13e0db4f41a1d507bf630f6b4d8b3549e188da96f1848a64d401de72cf17b3a937e68a289ccd90a20d13c16f0c86f6a8bc25ce829124ed21166c6160

  • SSDEEP

    768:cmPKcuwzG1juj9/m+NedCVgdcq2yBCeGTS4NoL3pK2cPJ8:cXcGjg9u+NedGgdH2yB+aDpZcR8

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      686e197bc7c5e5b72e7388d36647ea2b_JaffaCakes118

    • Size

      45KB

    • MD5

      686e197bc7c5e5b72e7388d36647ea2b

    • SHA1

      db05caf45a8594fc3b624475348e54b4b73ee4b3

    • SHA256

      4d59602413c44feabdf6ed46cd420b174f800e4a1c795808ce24534d8ea6f4c5

    • SHA512

      3a9295ef13e0db4f41a1d507bf630f6b4d8b3549e188da96f1848a64d401de72cf17b3a937e68a289ccd90a20d13c16f0c86f6a8bc25ce829124ed21166c6160

    • SSDEEP

      768:cmPKcuwzG1juj9/m+NedCVgdcq2yBCeGTS4NoL3pK2cPJ8:cXcGjg9u+NedGgdH2yB+aDpZcR8

    Score
    8/10
    evasionpersistence

    • Adds policy Run key to start application

      persistence

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks