Overview

overview

8

Static

static

3

2abe014851...18.exe

windows7-x64

8

2abe014851...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118

  • Size

    1.7MB

  • Sample

    240708-de6e3aygrp

  • MD5

    2abe014851fba1a1f9d7ed18db917c8c

  • SHA1

    bf25debd38148339f97831fd4b388e0f3bae8694

  • SHA256

    abd726fe2c60842d8308a05fb28e5d71f4e86e8d2df834d3b1b8099e4d69d081

  • SHA512

    9c0b5ea3e8e4865d3480639e3acbd5f196e5d8f318c6e4b82741b64d486f8ba64965b0dd64617d4165236a2c245f23b84c8aa65368c0dae5af0d9d0a422b2fa2

  • SSDEEP

    24576:Ao7MPQg7P1/er8/wIawbnErJnOW5AWTklyo5ZThqvW8wmr2hjjAsama1lVrZwXdY:AISrPUQzDO89qu9h/Ax1lAy

Score
8/10
persistence

Malware Config

Targets

    • Target

      2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118

    • Size

      1.7MB

    • MD5

      2abe014851fba1a1f9d7ed18db917c8c

    • SHA1

      bf25debd38148339f97831fd4b388e0f3bae8694

    • SHA256

      abd726fe2c60842d8308a05fb28e5d71f4e86e8d2df834d3b1b8099e4d69d081

    • SHA512

      9c0b5ea3e8e4865d3480639e3acbd5f196e5d8f318c6e4b82741b64d486f8ba64965b0dd64617d4165236a2c245f23b84c8aa65368c0dae5af0d9d0a422b2fa2

    • SSDEEP

      24576:Ao7MPQg7P1/er8/wIawbnErJnOW5AWTklyo5ZThqvW8wmr2hjjAsama1lVrZwXdY:AISrPUQzDO89qu9h/Ax1lAy

    Score
    8/10
    persistence

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks