General
-
Target
764851f283c32f92d717e362e2ecc7d0_JaffaCakes118
-
Size
3.7MB
-
Sample
240726-3z92esweqb
-
MD5
764851f283c32f92d717e362e2ecc7d0
-
SHA1
52618131cf54f0aa99b2d5b864838679a6023fd5
-
SHA256
cf7d78f9b7dde9d792a6062ca776c7abf038b9b8051fd2ba625f74bf976360df
-
SHA512
a0e1e256d3b562da57fdb867cbc013e80ffb961210928036d629f5f11d928086f981bd9b2999b93db70ad7df4e42808edc364ecc60fd63c970a7fba781a8d1cb
-
SSDEEP
98304:GqIxPSmAzlkauUpDvOnuhBIw0U1tIA+H5mFN3fm:GjPSmIOJnuhBYmFRO
Malware Config
Targets
-
-
Target
764851f283c32f92d717e362e2ecc7d0_JaffaCakes118
-
Size
3.7MB
-
MD5
764851f283c32f92d717e362e2ecc7d0
-
SHA1
52618131cf54f0aa99b2d5b864838679a6023fd5
-
SHA256
cf7d78f9b7dde9d792a6062ca776c7abf038b9b8051fd2ba625f74bf976360df
-
SHA512
a0e1e256d3b562da57fdb867cbc013e80ffb961210928036d629f5f11d928086f981bd9b2999b93db70ad7df4e42808edc364ecc60fd63c970a7fba781a8d1cb
-
SSDEEP
98304:GqIxPSmAzlkauUpDvOnuhBIw0U1tIA+H5mFN3fm:GjPSmIOJnuhBYmFRO
Score10/10-
Modifies WinLogon for persistence
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Modifies WinLogon
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2