Overview

overview

10

Static

static

3

81c4f9963d...18.exe

windows7-x64

10

81c4f9963d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81c4f9963dd2099915fd4e6f54dad969_JaffaCakes118

  • Size

    64KB

  • Sample

    240801-zy79na1apc

  • MD5

    81c4f9963dd2099915fd4e6f54dad969

  • SHA1

    f155b91ef95f08884e01e81d3938d8fb1bece37e

  • SHA256

    aca81d6f1061a026df786c014c6599faf8bb77bdba7c7ecf902aed5cb3940541

  • SHA512

    042ec8438e47a6b7b95122abed3b7f10537aba1995f4bacf7067a155257107638f654e68a03ae0a807ce9a2b04f0af6ee0bc6fd02be105042d11602a5986f2f4

  • SSDEEP

    768:7XK1Jsz/2COCKvxPD3WDKaZbO0lBo+fKpxcP60BPYXcgIufVXHo+DNXK:rOJsz/2HCKvRLUipy9BPkcgIutXfDZ

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      81c4f9963dd2099915fd4e6f54dad969_JaffaCakes118

    • Size

      64KB

    • MD5

      81c4f9963dd2099915fd4e6f54dad969

    • SHA1

      f155b91ef95f08884e01e81d3938d8fb1bece37e

    • SHA256

      aca81d6f1061a026df786c014c6599faf8bb77bdba7c7ecf902aed5cb3940541

    • SHA512

      042ec8438e47a6b7b95122abed3b7f10537aba1995f4bacf7067a155257107638f654e68a03ae0a807ce9a2b04f0af6ee0bc6fd02be105042d11602a5986f2f4

    • SSDEEP

      768:7XK1Jsz/2COCKvxPD3WDKaZbO0lBo+fKpxcP60BPYXcgIufVXHo+DNXK:rOJsz/2HCKvRLUipy9BPkcgIutXfDZ

    Score
    10/10
    discoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

5
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks