Overview

overview

10

Static

static

3

820f8ec1af...18.exe

windows7-x64

10

820f8ec1af...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    820f8ec1afebc0674863a9d7b2888faf_JaffaCakes118

  • Size

    719KB

  • Sample

    240529-1rlmrabh98

  • MD5

    820f8ec1afebc0674863a9d7b2888faf

  • SHA1

    c8deab450bccb5e381292f6c480f7d11acae8e16

  • SHA256

    55f070aa11ffdf68d101ae3a6f5fa90ecda20d314a85dc6bd34ee192bda22013

  • SHA512

    b25729d597829e3c4cf134efa023445bf1c76067d1e20cd94beed1322f606e63d39d9d7b6bef780b9ed26bb6c5dd77cdd53d6a9814c2ee53663d766103336daf

  • SSDEEP

    12288:UZWtI6RkyHeZJys73dOvXDpNjNe8zwOFHeZJys73dOvXDpNjNe8zWoXw:UuhayHeZJ8NI8zLHeZJ8NI8zWew

Score
10/10
evasionexecutionpersistence

Malware Config

Targets

    • Target

      820f8ec1afebc0674863a9d7b2888faf_JaffaCakes118

    • Size

      719KB

    • MD5

      820f8ec1afebc0674863a9d7b2888faf

    • SHA1

      c8deab450bccb5e381292f6c480f7d11acae8e16

    • SHA256

      55f070aa11ffdf68d101ae3a6f5fa90ecda20d314a85dc6bd34ee192bda22013

    • SHA512

      b25729d597829e3c4cf134efa023445bf1c76067d1e20cd94beed1322f606e63d39d9d7b6bef780b9ed26bb6c5dd77cdd53d6a9814c2ee53663d766103336daf

    • SSDEEP

      12288:UZWtI6RkyHeZJys73dOvXDpNjNe8zwOFHeZJys73dOvXDpNjNe8zWoXw:UuhayHeZJ8NI8zLHeZJ8NI8zWew

    Score
    10/10
    evasionexecutionpersistence

    • Disables service(s)

      evasionexecution

    • Modifies visibility of file extensions in Explorer

      evasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks