General
-
Target
16ab03376da5a4e468ac570e18175983_JaffaCakes118
-
Size
3.0MB
-
Sample
240627-tsdj7szapc
-
MD5
16ab03376da5a4e468ac570e18175983
-
SHA1
5c13606e5d2f29d8318dcff2b203dda7f0ed4cf2
-
SHA256
12364385c422839e28f530d701dfb8a60c9abf0a8e66542a75855181cfb8ecf5
-
SHA512
f09207bd9fe95a532cbf57457a936d7501fe1a5f7d1c0f422b8986555306b8d4f762293c197807eeb9b3809b4c40a52f213854571f9b5c27f0e50754dabd2a7d
-
SSDEEP
49152:YC8NKR1+V8tgJd8lRA4flnIDkYOMwwnMb4PmyVEk8:r+CgalRA4dn1YOXwnS4rVEz
Malware Config
Targets
-
-
Target
16ab03376da5a4e468ac570e18175983_JaffaCakes118
-
Size
3.0MB
-
MD5
16ab03376da5a4e468ac570e18175983
-
SHA1
5c13606e5d2f29d8318dcff2b203dda7f0ed4cf2
-
SHA256
12364385c422839e28f530d701dfb8a60c9abf0a8e66542a75855181cfb8ecf5
-
SHA512
f09207bd9fe95a532cbf57457a936d7501fe1a5f7d1c0f422b8986555306b8d4f762293c197807eeb9b3809b4c40a52f213854571f9b5c27f0e50754dabd2a7d
-
SSDEEP
49152:YC8NKR1+V8tgJd8lRA4flnIDkYOMwwnMb4PmyVEk8:r+CgalRA4dn1YOXwnS4rVEz
Score10/10-
Disables service(s)
-
Modifies visibility of file extensions in Explorer
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1