General
-
Target
30703b00bfdc6b661e403f9cc0b0cf39_JaffaCakes118
-
Size
999KB
-
Sample
240709-p19v6avcpp
-
MD5
30703b00bfdc6b661e403f9cc0b0cf39
-
SHA1
4748c0308c48d4e46e1c02a882094268e8cb0ba4
-
SHA256
be4f0a1870bb5a60057663ed4ebca5743c167d00710e3f47fb45641719c1418c
-
SHA512
59196374d62c8815a86cae8595561ec3ca4c8615dc7ba6274171dd3bb809c090b564bb360f3a05aea8188bb56fa6f9457fd941d5ae0561d494b4e1e220c4cb0b
-
SSDEEP
12288:3ZWtI6RkTakupOB0xa3Cz/ktOVakupOB0xa3Cz/kJ:3uha2hOK6hOKK
Malware Config
Targets
-
-
Target
30703b00bfdc6b661e403f9cc0b0cf39_JaffaCakes118
-
Size
999KB
-
MD5
30703b00bfdc6b661e403f9cc0b0cf39
-
SHA1
4748c0308c48d4e46e1c02a882094268e8cb0ba4
-
SHA256
be4f0a1870bb5a60057663ed4ebca5743c167d00710e3f47fb45641719c1418c
-
SHA512
59196374d62c8815a86cae8595561ec3ca4c8615dc7ba6274171dd3bb809c090b564bb360f3a05aea8188bb56fa6f9457fd941d5ae0561d494b4e1e220c4cb0b
-
SSDEEP
12288:3ZWtI6RkTakupOB0xa3Cz/ktOVakupOB0xa3Cz/kJ:3uha2hOK6hOKK
Score10/10-
Disables service(s)
-
Modifies visibility of file extensions in Explorer
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1