Overview

overview

10

Static

static

3

4e191d1d47...18.exe

windows7-x64

10

4e191d1d47...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4e191d1d47c2dcf22c50daf9901bc1ec_JaffaCakes118

  • Size

    66KB

  • Sample

    240716-njczessgpg

  • MD5

    4e191d1d47c2dcf22c50daf9901bc1ec

  • SHA1

    f4844e38f701669aac3d0713c6136322c4855ee3

  • SHA256

    780b0a064aa933e34a919ef7ba52407bf3811a71dd061c72cefc2f12cf84e99d

  • SHA512

    970c8d14288ce92d67705ed04ddad95bcffed0a7e3fd10ecf6251f9277c50adaaaf2a1e6c461fd273a7e350d8ca30dfa15be72f3e77687431b3a8f9898990c0a

  • SSDEEP

    1536:sRyXwBrroJoDVEgIPb3iV72/QecvZ5rcs1:sEgZoJo2tj3O2/qv4s1

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      4e191d1d47c2dcf22c50daf9901bc1ec_JaffaCakes118

    • Size

      66KB

    • MD5

      4e191d1d47c2dcf22c50daf9901bc1ec

    • SHA1

      f4844e38f701669aac3d0713c6136322c4855ee3

    • SHA256

      780b0a064aa933e34a919ef7ba52407bf3811a71dd061c72cefc2f12cf84e99d

    • SHA512

      970c8d14288ce92d67705ed04ddad95bcffed0a7e3fd10ecf6251f9277c50adaaaf2a1e6c461fd273a7e350d8ca30dfa15be72f3e77687431b3a8f9898990c0a

    • SSDEEP

      1536:sRyXwBrroJoDVEgIPb3iV72/QecvZ5rcs1:sEgZoJo2tj3O2/qv4s1

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks