Overview

overview

8

Static

static

3

1825a18f77...18.exe

windows7-x64

8

1825a18f77...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1825a18f77f2cc4f807f575fd15be19f_JaffaCakes118

  • Size

    20KB

  • Sample

    240628-azc3gaterr

  • MD5

    1825a18f77f2cc4f807f575fd15be19f

  • SHA1

    430fcdbed17f3cdd5bfa5c7b2f652ecf3e2e8875

  • SHA256

    2b7b0e3f2671ab4629755355a47fcec41fdf134d03c70bb02fe0d75ca708a864

  • SHA512

    6287d96abcf1025a3a06fa968a9d5e96658eb897c92df850f87a548396ed781f53a469e23ec6fbe8df81ce84dce6348815d90d27b5925f7680ddc2f686de6f04

  • SSDEEP

    384:4M8M742vDxdfaoz1tqf4WV6SCybBjsBR9vcfqOMiPpu+RVen2qbkXq:4XM742nz1+zCy1jsnphOPpu+jSwa

Score
8/10
persistence

Malware Config

Targets

    • Target

      1825a18f77f2cc4f807f575fd15be19f_JaffaCakes118

    • Size

      20KB

    • MD5

      1825a18f77f2cc4f807f575fd15be19f

    • SHA1

      430fcdbed17f3cdd5bfa5c7b2f652ecf3e2e8875

    • SHA256

      2b7b0e3f2671ab4629755355a47fcec41fdf134d03c70bb02fe0d75ca708a864

    • SHA512

      6287d96abcf1025a3a06fa968a9d5e96658eb897c92df850f87a548396ed781f53a469e23ec6fbe8df81ce84dce6348815d90d27b5925f7680ddc2f686de6f04

    • SSDEEP

      384:4M8M742vDxdfaoz1tqf4WV6SCybBjsBR9vcfqOMiPpu+RVen2qbkXq:4XM742nz1+zCy1jsnphOPpu+jSwa

    Score
    8/10
    persistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks