Overview

overview

10

Static

static

1

6d1effa573...18.jar

windows7-x64

10

6d1effa573...18.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d1effa57399a9069941ef00e7fb4395_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240524-dfhqdsag2w

  • MD5

    6d1effa57399a9069941ef00e7fb4395

  • SHA1

    0b71d316c1ba0f3b50dc04cdfa6a5633e365f689

  • SHA256

    32c1b4b58f8ca037ce10bd67ba5e57adf07ef2dbe39cc1f31cfc3f105c0c6a42

  • SHA512

    83f5e953493cfa46ec0003d2fcda57a6f38f247854472040c45e4107d3442af8fcc869ae27a193cd5aac4c4078cdc1d79565486f100eb5c4d34d58a7c26c34ae

  • SSDEEP

    24576:l1cti3gUtgjrPEuKbdX9sMXTdsY5t7Kc5GPx:l1nvgXPEuK19sysM7DAPx

Score
10/10
adwinddiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      6d1effa57399a9069941ef00e7fb4395_JaffaCakes118

    • Size

      1.5MB

    • MD5

      6d1effa57399a9069941ef00e7fb4395

    • SHA1

      0b71d316c1ba0f3b50dc04cdfa6a5633e365f689

    • SHA256

      32c1b4b58f8ca037ce10bd67ba5e57adf07ef2dbe39cc1f31cfc3f105c0c6a42

    • SHA512

      83f5e953493cfa46ec0003d2fcda57a6f38f247854472040c45e4107d3442af8fcc869ae27a193cd5aac4c4078cdc1d79565486f100eb5c4d34d58a7c26c34ae

    • SSDEEP

      24576:l1cti3gUtgjrPEuKbdX9sMXTdsY5t7Kc5GPx:l1nvgXPEuK19sysM7DAPx

    Score
    10/10
    adwindevasionpersistencetrojandiscovery

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • UAC bypass

      evasiontrojan

    • Disables use of System Restore points

      evasion

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks