General
-
Target
2d18d5d44d36626688af749cdb9dc6d7_JaffaCakes118
-
Size
300KB
-
Sample
240708-vc24asydnj
-
MD5
2d18d5d44d36626688af749cdb9dc6d7
-
SHA1
810d228101a8de9761be74e58e446cb09da29b1e
-
SHA256
82f6930548df26e4a8bfcb17e3244a5fbe34c5a5f1002590727b0a1c62d5a7ef
-
SHA512
523766922d740134050f261e6ec340800b4d3f684fada0f24b6c79526b385d93526c5b7040eae388841710df91dadd6dac10646dd7b4e5c6e3b12210046bfc20
-
SSDEEP
6144:5uHOTl+lXDZJfLufs73dOk0XDpNjNOpys8wE2EBE2ENqa:gOTeZJys73dOvXDpNjNe83MNqa
Malware Config
Targets
-
-
Target
2d18d5d44d36626688af749cdb9dc6d7_JaffaCakes118
-
Size
300KB
-
MD5
2d18d5d44d36626688af749cdb9dc6d7
-
SHA1
810d228101a8de9761be74e58e446cb09da29b1e
-
SHA256
82f6930548df26e4a8bfcb17e3244a5fbe34c5a5f1002590727b0a1c62d5a7ef
-
SHA512
523766922d740134050f261e6ec340800b4d3f684fada0f24b6c79526b385d93526c5b7040eae388841710df91dadd6dac10646dd7b4e5c6e3b12210046bfc20
-
SSDEEP
6144:5uHOTl+lXDZJfLufs73dOk0XDpNjNOpys8wE2EBE2ENqa:gOTeZJys73dOvXDpNjNe83MNqa
Score10/10-
Disables service(s)
-
Modifies visibility of file extensions in Explorer
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1