Overview

overview

10

Static

static

3

646a548583...18.exe

windows7-x64

10

646a548583...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    646a5485835308d530815b7a4300b6df_JaffaCakes118

  • Size

    280KB

  • Sample

    240722-xqyddatblr

  • MD5

    646a5485835308d530815b7a4300b6df

  • SHA1

    8ae0f439a8fffd4ad990640b2dd61e4c16257f9a

  • SHA256

    6c3a89d82baa692fec41489fa1faecd927f397e5d0f30eceb2b1e5d85711ef6b

  • SHA512

    200122052bdb48c51bcfe92944d025ffd4bb7d4d7a2211df845f7def353165b04800d14aa239794bf5eb8fbd2082c970a4407aaa0a0883b33b02069d23ccb5e9

  • SSDEEP

    6144:SImIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNX/:EuydfiebOv

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      646a5485835308d530815b7a4300b6df_JaffaCakes118

    • Size

      280KB

    • MD5

      646a5485835308d530815b7a4300b6df

    • SHA1

      8ae0f439a8fffd4ad990640b2dd61e4c16257f9a

    • SHA256

      6c3a89d82baa692fec41489fa1faecd927f397e5d0f30eceb2b1e5d85711ef6b

    • SHA512

      200122052bdb48c51bcfe92944d025ffd4bb7d4d7a2211df845f7def353165b04800d14aa239794bf5eb8fbd2082c970a4407aaa0a0883b33b02069d23ccb5e9

    • SSDEEP

      6144:SImIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNX/:EuydfiebOv

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks