Overview

overview

10

Static

static

3

691b9fa3bf...18.exe

windows7-x64

10

691b9fa3bf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    691b9fa3bf569ed1d1afca092c7554f8_JaffaCakes118

  • Size

    3.4MB

  • Sample

    240523-aj5gsaee55

  • MD5

    691b9fa3bf569ed1d1afca092c7554f8

  • SHA1

    21fcab19cc46d2d0d5764f9a0eb344d81258e983

  • SHA256

    415bed6065fe76563492296570f1a7e091aadc5a6d4f727385e561235f981f32

  • SHA512

    1b3c1455091d24945dc06c6594375f3577eb984d2d484a571d5a2c446418825f480806243e561c1c54854a0820ce2a20d90e6bc6af9338f2d1f1a0deb74d6e74

  • SSDEEP

    49152:bO8YerQZbd2C8YerQZbd2C8YerQZbd2C8YerQZbd2C8YerQZbd2CD:nrQZwrQZwrQZwrQZwrQZx

Score
10/10
evasionexecutionpersistence

Malware Config

Targets

    • Target

      691b9fa3bf569ed1d1afca092c7554f8_JaffaCakes118

    • Size

      3.4MB

    • MD5

      691b9fa3bf569ed1d1afca092c7554f8

    • SHA1

      21fcab19cc46d2d0d5764f9a0eb344d81258e983

    • SHA256

      415bed6065fe76563492296570f1a7e091aadc5a6d4f727385e561235f981f32

    • SHA512

      1b3c1455091d24945dc06c6594375f3577eb984d2d484a571d5a2c446418825f480806243e561c1c54854a0820ce2a20d90e6bc6af9338f2d1f1a0deb74d6e74

    • SSDEEP

      49152:bO8YerQZbd2C8YerQZbd2C8YerQZbd2C8YerQZbd2C8YerQZbd2CD:nrQZwrQZwrQZwrQZwrQZx

    Score
    10/10
    evasionexecutionpersistence

    • Disables service(s)

      evasionexecution

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks