Overview

overview

8

Static

static

3

70810c67fb...18.exe

windows7-x64

8

70810c67fb...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70810c67fbd7e10408007575700eb58c_JaffaCakes118

  • Size

    74KB

  • Sample

    240725-vrabtswgqc

  • MD5

    70810c67fbd7e10408007575700eb58c

  • SHA1

    d01ba0465b72d09daf49c7a2f7b9d4aa3df50550

  • SHA256

    d74f756789448500f1921e8c72b32c2ac919501d5d932bad7015469d6b46d3dc

  • SHA512

    f1e540706555924010a8ee2b2baa2d049c1acfcc24bc7837a5169b18db42380fd9b8213a5d0861886bb10376572c93257519de2ac3419c752cd346fb6a79b8bf

  • SSDEEP

    1536:nKt+1r5yONJ3FnToIfItdjxsHEF7pcpM57H7SvtyIkfHu48j:K8r5yONJ3tTBfqTsCUM5ivtyIkvm

Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Targets

    • Target

      70810c67fbd7e10408007575700eb58c_JaffaCakes118

    • Size

      74KB

    • MD5

      70810c67fbd7e10408007575700eb58c

    • SHA1

      d01ba0465b72d09daf49c7a2f7b9d4aa3df50550

    • SHA256

      d74f756789448500f1921e8c72b32c2ac919501d5d932bad7015469d6b46d3dc

    • SHA512

      f1e540706555924010a8ee2b2baa2d049c1acfcc24bc7837a5169b18db42380fd9b8213a5d0861886bb10376572c93257519de2ac3419c752cd346fb6a79b8bf

    • SSDEEP

      1536:nKt+1r5yONJ3FnToIfItdjxsHEF7pcpM57H7SvtyIkfHu48j:K8r5yONJ3tTBfqTsCUM5ivtyIkvm

    Score
    8/10
    defense_evasiondiscoverypersistence

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks