General
-
Target
0fa20cadd3980a2a47879625e2e26916_JaffaCakes118
-
Size
1.1MB
-
Sample
240625-1kcfhaveng
-
MD5
0fa20cadd3980a2a47879625e2e26916
-
SHA1
36028cad4c4942f740e3599c0c69c4a8db5daba1
-
SHA256
3f21dba1eb94afe0e4cd78610e6ffca0382c2c5eda353863898ed18191a1b689
-
SHA512
c590842c320bee247ab8632a4c3ff32299646e92154becec0ae805f520e1ab6ffb78f08c56389a418fd46e46086460062e08434313fbc3fa061b3ab7544a6f11
-
SSDEEP
24576:3uhatt2eZJ8NI82rerQZb+md4wmUJqsaS2ROv:YC82rerQZbd2YlqROv
Malware Config
Targets
-
-
Target
0fa20cadd3980a2a47879625e2e26916_JaffaCakes118
-
Size
1.1MB
-
MD5
0fa20cadd3980a2a47879625e2e26916
-
SHA1
36028cad4c4942f740e3599c0c69c4a8db5daba1
-
SHA256
3f21dba1eb94afe0e4cd78610e6ffca0382c2c5eda353863898ed18191a1b689
-
SHA512
c590842c320bee247ab8632a4c3ff32299646e92154becec0ae805f520e1ab6ffb78f08c56389a418fd46e46086460062e08434313fbc3fa061b3ab7544a6f11
-
SSDEEP
24576:3uhatt2eZJ8NI82rerQZb+md4wmUJqsaS2ROv:YC82rerQZbd2YlqROv
Score10/10-
Disables service(s)
-
Modifies visibility of file extensions in Explorer
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1