Overview

overview

10

Static

static

3

3fe380a0f6...18.exe

windows7-x64

10

3fe380a0f6...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fe380a0f6700f1ad5e771c5ae0523ef_JaffaCakes118

  • Size

    82KB

  • Sample

    240713-c9y4ssvdja

  • MD5

    3fe380a0f6700f1ad5e771c5ae0523ef

  • SHA1

    d0bb4ec743de0c6f71df9151a5f8e7658e258bdd

  • SHA256

    12ef14a5a96ec0411bdd008c46377fde3beff99148a7c7d6a3f2750cbf337780

  • SHA512

    fc876e53dd42b90533f130750a2b3e5c48fa29991980bac224f1de7b9432bc67754cb11fe40502e45749ae6f9e138654fcdc97330db390eafd62e7de6b26ee8f

  • SSDEEP

    1536:bM4SynmeXwjr4XxuPZOcs1aiL7CDogND+XEjskmK9EVh6:bmumegIas1aMGBD+XEDEVh6

Score
10/10
collectiondiscoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      3fe380a0f6700f1ad5e771c5ae0523ef_JaffaCakes118

    • Size

      82KB

    • MD5

      3fe380a0f6700f1ad5e771c5ae0523ef

    • SHA1

      d0bb4ec743de0c6f71df9151a5f8e7658e258bdd

    • SHA256

      12ef14a5a96ec0411bdd008c46377fde3beff99148a7c7d6a3f2750cbf337780

    • SHA512

      fc876e53dd42b90533f130750a2b3e5c48fa29991980bac224f1de7b9432bc67754cb11fe40502e45749ae6f9e138654fcdc97330db390eafd62e7de6b26ee8f

    • SSDEEP

      1536:bM4SynmeXwjr4XxuPZOcs1aiL7CDogND+XEjskmK9EVh6:bmumegIas1aMGBD+XEDEVh6

    Score
    10/10
    collectiondiscoverypersistenceprivilege_escalation

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Drops file in Drivers directory

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks