Overview

overview

10

Static

static

3

8512dc2ed5...18.exe

windows7-x64

10

8512dc2ed5...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8512dc2ed565857f3d30211a7ebccf56_JaffaCakes118

  • Size

    168KB

  • Sample

    240810-gzy39syekl

  • MD5

    8512dc2ed565857f3d30211a7ebccf56

  • SHA1

    989866ab2972cfba78cde7e32c9ba33c99091e85

  • SHA256

    b3e54cf5aea671f07b64a3e2cadfa1dd3f8fa2c115cb0b0b966df2dd45658b1f

  • SHA512

    919b46a9ae3c1123c35ee3bcbea5bbb25af2f07ab9ae7637f9d1df7d5710234c314cea8765108e539e362bf40e469594f287922842fed1b1b62d7b800d9c0324

  • SSDEEP

    1536:Dz43i6EJ02LyV3kFdp+0zI1ZBjhRDmmHeIcinLJcoHQHF3i6EJ02LyV3rEpn:DzLyV3kF21im+YLzLyV3Ipn

Score
10/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      8512dc2ed565857f3d30211a7ebccf56_JaffaCakes118

    • Size

      168KB

    • MD5

      8512dc2ed565857f3d30211a7ebccf56

    • SHA1

      989866ab2972cfba78cde7e32c9ba33c99091e85

    • SHA256

      b3e54cf5aea671f07b64a3e2cadfa1dd3f8fa2c115cb0b0b966df2dd45658b1f

    • SHA512

      919b46a9ae3c1123c35ee3bcbea5bbb25af2f07ab9ae7637f9d1df7d5710234c314cea8765108e539e362bf40e469594f287922842fed1b1b62d7b800d9c0324

    • SSDEEP

      1536:Dz43i6EJ02LyV3kFdp+0zI1ZBjhRDmmHeIcinLJcoHQHF3i6EJ02LyV3rEpn:DzLyV3kF21im+YLzLyV3Ipn

    Score
    10/10
    defense_evasiondiscoveryevasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Adds Run key to start application

      persistence

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Hide Artifacts: Hidden Users

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

5
T1564

Hidden Files and Directories

4
T1564.001

Hidden Users

1
T1564.002

Modify Registry

3
T1112

Credential Access

Discovery

Network Share Discovery

1
T1135

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks