Overview

overview

10

Static

static

3

4793660db5...18.exe

windows7-x64

10

4793660db5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4793660db5a3dc299ed73148039e8d6d_JaffaCakes118

  • Size

    2.5MB

  • Sample

    240715-bg4cdatdkc

  • MD5

    4793660db5a3dc299ed73148039e8d6d

  • SHA1

    5179950ec56b17b13530e635b4c564d3ce7a4ddf

  • SHA256

    69dacc5c93020903688fdbe5896c2134459149e7b1195e9062229d2397c87f74

  • SHA512

    0a49b02a1232c3822ae0ed5ac4ea18ea45b0b5670af8f59a1d1c0c11b20dd202ae0f593d39ab7e5f2c13f1b9713da622e9ace5a0283a3bdc9eb14fdb49a191ef

  • SSDEEP

    49152:leAR0wj1vnVPIyyWxwChYAgsMMMMMMyXZkQsC/yje/5IqNTYlMbv/e3yCH:10wj1/fylAMMMMMMyJkQv/59Ylmo

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      4793660db5a3dc299ed73148039e8d6d_JaffaCakes118

    • Size

      2.5MB

    • MD5

      4793660db5a3dc299ed73148039e8d6d

    • SHA1

      5179950ec56b17b13530e635b4c564d3ce7a4ddf

    • SHA256

      69dacc5c93020903688fdbe5896c2134459149e7b1195e9062229d2397c87f74

    • SHA512

      0a49b02a1232c3822ae0ed5ac4ea18ea45b0b5670af8f59a1d1c0c11b20dd202ae0f593d39ab7e5f2c13f1b9713da622e9ace5a0283a3bdc9eb14fdb49a191ef

    • SSDEEP

      49152:leAR0wj1vnVPIyyWxwChYAgsMMMMMMyXZkQsC/yje/5IqNTYlMbv/e3yCH:10wj1/fylAMMMMMMyJkQv/59Ylmo

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks