Overview

overview

10

Static

static

3

19c0e80a70...18.exe

windows7-x64

10

19c0e80a70...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    19c0e80a70775202e2cc7caef3f62941_JaffaCakes118

  • Size

    320KB

  • Sample

    240628-l9p1kawgrl

  • MD5

    19c0e80a70775202e2cc7caef3f62941

  • SHA1

    6338d705129aa5ecbcdf7d52bc6d7aa2a3145099

  • SHA256

    06fc70c43fb488a84dd03b1ad03a3ae6e927c5c789a3f7f25aa3cf0a36de98ad

  • SHA512

    be1d25f7b10501c2d7551aabba06dc4358e83fc21fcaf9cb5c4f4c4849b318ecf69a1c0115b01effd10080d0d29d208c62ebae132f172b187ab833e1dd134625

  • SSDEEP

    6144:Hy/vv/Bn/NbYl/a+fCf8SLJOIrhTyMMGRlq:S/vRn/NH+qL8nMMsl

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      19c0e80a70775202e2cc7caef3f62941_JaffaCakes118

    • Size

      320KB

    • MD5

      19c0e80a70775202e2cc7caef3f62941

    • SHA1

      6338d705129aa5ecbcdf7d52bc6d7aa2a3145099

    • SHA256

      06fc70c43fb488a84dd03b1ad03a3ae6e927c5c789a3f7f25aa3cf0a36de98ad

    • SHA512

      be1d25f7b10501c2d7551aabba06dc4358e83fc21fcaf9cb5c4f4c4849b318ecf69a1c0115b01effd10080d0d29d208c62ebae132f172b187ab833e1dd134625

    • SSDEEP

      6144:Hy/vv/Bn/NbYl/a+fCf8SLJOIrhTyMMGRlq:S/vRn/NH+qL8nMMsl

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks