Overview

overview

10

Static

static

3

16f9024910...18.exe

windows7-x64

10

16f9024910...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16f902491090535d69774895fde63bf4_JaffaCakes118

  • Size

    124KB

  • Sample

    240627-wnr8xavglq

  • MD5

    16f902491090535d69774895fde63bf4

  • SHA1

    f7273cac1b3ed08cc15275a5eb3a6771daa6b91b

  • SHA256

    76869418b743d0c1c2ff4241f62f2ae0c63af1233dfb577eb71baad3be896f96

  • SHA512

    1a32ec1437b121956a0a366ffa93511b42c17a59b032333482fa5eea5b462805772f02014a808a95f7dca48e050d23cd5c4305a67c37624c4441acafe12ac691

  • SSDEEP

    1536:ylUNYw+Awk9/0WmGOq4OroRm2oO0jYlcwrLpdUGvd:yxAws/ldrom9cDr9OG

Score
10/10
persistence

Malware Config

Targets

    • Target

      16f902491090535d69774895fde63bf4_JaffaCakes118

    • Size

      124KB

    • MD5

      16f902491090535d69774895fde63bf4

    • SHA1

      f7273cac1b3ed08cc15275a5eb3a6771daa6b91b

    • SHA256

      76869418b743d0c1c2ff4241f62f2ae0c63af1233dfb577eb71baad3be896f96

    • SHA512

      1a32ec1437b121956a0a366ffa93511b42c17a59b032333482fa5eea5b462805772f02014a808a95f7dca48e050d23cd5c4305a67c37624c4441acafe12ac691

    • SSDEEP

      1536:ylUNYw+Awk9/0WmGOq4OroRm2oO0jYlcwrLpdUGvd:yxAws/ldrom9cDr9OG

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks