Overview

overview

10

Static

static

3

1586cc3a13...18.exe

windows7-x64

10

1586cc3a13...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1586cc3a130eecae62a61fae4e4db332_JaffaCakes118

  • Size

    456KB

  • Sample

    240627-lntfvsvbrf

  • MD5

    1586cc3a130eecae62a61fae4e4db332

  • SHA1

    aa30896f6f3969335a5ac3bcc7023a7817875700

  • SHA256

    0799ce6bca68ee46cd9c7c6a4519bd1182678176e38e49a3415f759159eec046

  • SHA512

    a754074814fef94e0b0d6b73018eff7b1c94cecfbcc693db99df5dfe73d6159910dcc4c3b3e37de9b67014b66c4a8c0877f1b9e2bd60fedea429607609186651

  • SSDEEP

    6144:zg+GnUR3dZVzcqON3wlrfnvoGL4+kPKy/OIjw/5UR3dZVzcqON3wlrfnOeg+BKni:vVtQcrHapjy6VtQcrgnwXQPk

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      1586cc3a130eecae62a61fae4e4db332_JaffaCakes118

    • Size

      456KB

    • MD5

      1586cc3a130eecae62a61fae4e4db332

    • SHA1

      aa30896f6f3969335a5ac3bcc7023a7817875700

    • SHA256

      0799ce6bca68ee46cd9c7c6a4519bd1182678176e38e49a3415f759159eec046

    • SHA512

      a754074814fef94e0b0d6b73018eff7b1c94cecfbcc693db99df5dfe73d6159910dcc4c3b3e37de9b67014b66c4a8c0877f1b9e2bd60fedea429607609186651

    • SSDEEP

      6144:zg+GnUR3dZVzcqON3wlrfnvoGL4+kPKy/OIjw/5UR3dZVzcqON3wlrfnOeg+BKni:vVtQcrHapjy6VtQcrgnwXQPk

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks