General
-
Target
170b518ecbd9c2de48acf5193163a11e_JaffaCakes118
-
Size
1.2MB
-
Sample
240627-w3a8yawekl
-
MD5
170b518ecbd9c2de48acf5193163a11e
-
SHA1
bc6043f9a12ea7d29d28061ba8a1bccd6e0942f9
-
SHA256
cf8cbf1d159d1c55dcd0f3e7599b3077a428bb04111a3e66fd044d6851b79bc4
-
SHA512
4b2afe77e140ec8cc67b08fda196e7bf9bc0a055c4ed13dd4d51324cab519fb59cddfd1f53a3b1982b454e01d00c75049e97012308ce9f732a1afe0e3cfc519d
-
SSDEEP
12288:3ZWtI6RkmOB0fOoOB0ferQZb+md4w1UXzbiZKm4H8zq9FjtdX:3uhamO6OCerQZb+md4wmo4HTFj
Malware Config
Targets
-
-
Target
170b518ecbd9c2de48acf5193163a11e_JaffaCakes118
-
Size
1.2MB
-
MD5
170b518ecbd9c2de48acf5193163a11e
-
SHA1
bc6043f9a12ea7d29d28061ba8a1bccd6e0942f9
-
SHA256
cf8cbf1d159d1c55dcd0f3e7599b3077a428bb04111a3e66fd044d6851b79bc4
-
SHA512
4b2afe77e140ec8cc67b08fda196e7bf9bc0a055c4ed13dd4d51324cab519fb59cddfd1f53a3b1982b454e01d00c75049e97012308ce9f732a1afe0e3cfc519d
-
SSDEEP
12288:3ZWtI6RkmOB0fOoOB0ferQZb+md4w1UXzbiZKm4H8zq9FjtdX:3uhamO6OCerQZb+md4wmo4HTFj
Score10/10-
Disables service(s)
-
Modifies visibility of file extensions in Explorer
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1