Overview

overview

8

Static

static

7

475057d7e3...18.exe

windows7-x64

8

475057d7e3...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    475057d7e3b99fc8ea9f0b9638e44bec_JaffaCakes118

  • Size

    3.2MB

  • Sample

    240714-3t56aa1anc

  • MD5

    475057d7e3b99fc8ea9f0b9638e44bec

  • SHA1

    c848df80e796c792d375a2dc0244b5fec9978b0f

  • SHA256

    b272d11b1b95a1fcc7791488eb46b7a264b96bfcbd0b6aad7d6f719d970358ac

  • SHA512

    2769d84c45c5d34197e5d50995205000187f9ad10446da44783a0bac67dfac77bec8e6c330cc41b775001744889d00b984774326fda3e77a99178d6006f9a974

  • SSDEEP

    49152:sSMDFkGASmdmDUpDMlQGymxa3dbeTuinBuR2+kksLf91Es1yxFfVkwO2rytjKaHa:sSMDZAnQplQYxgnFnkH/XuUtOsau7

Score
8/10
aspackv2evasionexecutionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      475057d7e3b99fc8ea9f0b9638e44bec_JaffaCakes118

    • Size

      3.2MB

    • MD5

      475057d7e3b99fc8ea9f0b9638e44bec

    • SHA1

      c848df80e796c792d375a2dc0244b5fec9978b0f

    • SHA256

      b272d11b1b95a1fcc7791488eb46b7a264b96bfcbd0b6aad7d6f719d970358ac

    • SHA512

      2769d84c45c5d34197e5d50995205000187f9ad10446da44783a0bac67dfac77bec8e6c330cc41b775001744889d00b984774326fda3e77a99178d6006f9a974

    • SSDEEP

      49152:sSMDFkGASmdmDUpDMlQGymxa3dbeTuinBuR2+kksLf91Es1yxFfVkwO2rytjKaHa:sSMDZAnQplQYxgnFnkH/XuUtOsau7

    Score
    8/10
    evasionexecutionpersistenceprivilege_escalationaspackv2

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasionexecution

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks