Overview

overview

10

Static

static

3

84aec62929...18.exe

windows7-x64

10

84aec62929...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    84aec629298e5acc3ec493a5b766ea93_JaffaCakes118

  • Size

    260KB

  • Sample

    240810-ear8bavajk

  • MD5

    84aec629298e5acc3ec493a5b766ea93

  • SHA1

    2eac2aa958d6d97ec702d0471280c7b4162c1e65

  • SHA256

    d91753376263495f43c1f3a65dc2d14718ba3605c503f0ec9ab335110eb48b86

  • SHA512

    bdc2e9b32cc6055cad9a9f823d1493082886af498db9c6a2b0d7f1a2e62f135106748222bf81fe70b8fe41b0e34f10f79ec931c5c0d73f4273f149fe1b5040ea

  • SSDEEP

    6144:+cUPYIe0e7rtVTDE/JSH2jAgzbVabV2aLGMxK:YPYQ8rtVnCJSH2lVab5Kt

Score
10/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      84aec629298e5acc3ec493a5b766ea93_JaffaCakes118

    • Size

      260KB

    • MD5

      84aec629298e5acc3ec493a5b766ea93

    • SHA1

      2eac2aa958d6d97ec702d0471280c7b4162c1e65

    • SHA256

      d91753376263495f43c1f3a65dc2d14718ba3605c503f0ec9ab335110eb48b86

    • SHA512

      bdc2e9b32cc6055cad9a9f823d1493082886af498db9c6a2b0d7f1a2e62f135106748222bf81fe70b8fe41b0e34f10f79ec931c5c0d73f4273f149fe1b5040ea

    • SSDEEP

      6144:+cUPYIe0e7rtVTDE/JSH2jAgzbVabV2aLGMxK:YPYQ8rtVnCJSH2lVab5Kt

    Score
    10/10
    defense_evasiondiscoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks