Overview

overview

10

Static

static

3

24263718a4...18.exe

windows7-x64

10

24263718a4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24263718a48217f8e2ee47ce68d7941e_JaffaCakes118

  • Size

    105KB

  • Sample

    240704-bsh6ksycpa

  • MD5

    24263718a48217f8e2ee47ce68d7941e

  • SHA1

    29a9a3ab7065e39224ffd237d394068a9998ce35

  • SHA256

    fb0424ef658149b312af8622a38839d1c11555a811f921135fe18b582fee9e36

  • SHA512

    4e09be6f1614f857bb0ae5a7abed5e057c13aa678c5e95d495790b293e971aa653b4a4ef102cfa53587448fe3a89d2b51dc3314a844ed278dec7e266fd06f944

  • SSDEEP

    3072:YZjurA1K+w3rbeHsyxmAbl6LusWDJ8LVb5CS:yV9wAiAbmushLVt/

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      24263718a48217f8e2ee47ce68d7941e_JaffaCakes118

    • Size

      105KB

    • MD5

      24263718a48217f8e2ee47ce68d7941e

    • SHA1

      29a9a3ab7065e39224ffd237d394068a9998ce35

    • SHA256

      fb0424ef658149b312af8622a38839d1c11555a811f921135fe18b582fee9e36

    • SHA512

      4e09be6f1614f857bb0ae5a7abed5e057c13aa678c5e95d495790b293e971aa653b4a4ef102cfa53587448fe3a89d2b51dc3314a844ed278dec7e266fd06f944

    • SSDEEP

      3072:YZjurA1K+w3rbeHsyxmAbl6LusWDJ8LVb5CS:yV9wAiAbmushLVt/

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Sets service image path in registry

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks