Overview

overview

10

Static

static

3

8be03b711f...18.exe

windows7-x64

10

8be03b711f...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8be03b711fa02f6bb38a34662e5dc287_JaffaCakes118

  • Size

    165KB

  • Sample

    240811-zdxbnaxanm

  • MD5

    8be03b711fa02f6bb38a34662e5dc287

  • SHA1

    67af737c040dac21fa70fde9874656b2119b28f3

  • SHA256

    5d95cd36c01a47b949e4da27470ec30862a7e3e4b9739bb63c8f6825643dc522

  • SHA512

    63056db2ffffde6025c3e4a56bd17c7837a23fef58056941b41edfc72ef6cc265f0d9bc904fce5a461dd453358935b0a316a14bd68b1bb77385639a8e4d916f7

  • SSDEEP

    3072:SPY8wDT1REIR1+aJe1mgawzxsBub861jIHxowURwMYc17QQSHmwBX:DEIRUTV5nNYNQct

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      8be03b711fa02f6bb38a34662e5dc287_JaffaCakes118

    • Size

      165KB

    • MD5

      8be03b711fa02f6bb38a34662e5dc287

    • SHA1

      67af737c040dac21fa70fde9874656b2119b28f3

    • SHA256

      5d95cd36c01a47b949e4da27470ec30862a7e3e4b9739bb63c8f6825643dc522

    • SHA512

      63056db2ffffde6025c3e4a56bd17c7837a23fef58056941b41edfc72ef6cc265f0d9bc904fce5a461dd453358935b0a316a14bd68b1bb77385639a8e4d916f7

    • SSDEEP

      3072:SPY8wDT1REIR1+aJe1mgawzxsBub861jIHxowURwMYc17QQSHmwBX:DEIRUTV5nNYNQct

    Score
    10/10
    discoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks