Overview

overview

10

Static

static

3

16f806ec27...18.exe

windows7-x64

10

16f806ec27...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    16f806ec27e3cc48caa91b392c863ac8_JaffaCakes118

  • Size

    196KB

  • Sample

    240627-wm39sashmf

  • MD5

    16f806ec27e3cc48caa91b392c863ac8

  • SHA1

    811173552d8c22cd67e1177df39d53a66d708ef2

  • SHA256

    5fc9a019bad8d4b0b4168a3454674dab97c8376ce78b44cabcc8f4ec15e2fda4

  • SHA512

    8dd7a5be5aceddc73bd183b46d25fdb357c70d0b007f6c210cf1c519fc72ec0921e81e747f7151c378f389ae608a02839129a51a980f7cf89605055eae2a87c6

  • SSDEEP

    3072:ly1AAgPAF0tQ9nLHbB9WmvA7vejJWKvE+KmZRY:sGm4QxL7B9WjjejJW5Mu

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      16f806ec27e3cc48caa91b392c863ac8_JaffaCakes118

    • Size

      196KB

    • MD5

      16f806ec27e3cc48caa91b392c863ac8

    • SHA1

      811173552d8c22cd67e1177df39d53a66d708ef2

    • SHA256

      5fc9a019bad8d4b0b4168a3454674dab97c8376ce78b44cabcc8f4ec15e2fda4

    • SHA512

      8dd7a5be5aceddc73bd183b46d25fdb357c70d0b007f6c210cf1c519fc72ec0921e81e747f7151c378f389ae608a02839129a51a980f7cf89605055eae2a87c6

    • SSDEEP

      3072:ly1AAgPAF0tQ9nLHbB9WmvA7vejJWKvE+KmZRY:sGm4QxL7B9WjjejJW5Mu

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks