Overview

overview

10

Static

static

3

8bf20bfc18...18.exe

windows7-x64

10

8bf20bfc18...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8bf20bfc18d0eccfafa105cb9c0ab826_JaffaCakes118

  • Size

    511KB

  • Sample

    240811-zrwmaasbkc

  • MD5

    8bf20bfc18d0eccfafa105cb9c0ab826

  • SHA1

    9aff38f20566374adae457bf76822ebac88f1dd2

  • SHA256

    323fff89eace9d8c40d8f66893e617309ee21f2ab75cfae5f5b3cc795d4110e7

  • SHA512

    a0539fa07789875d4c2afc31e7d83c317d0c3d32de79c73647e17376bf664cba425975df97640fbe722566284b9371da29e8d6998eb97f93e1a1253b9d7f56e2

  • SSDEEP

    12288:o3W85Eau61btezvs6VT4wl5TMnAjqhyrDLWPzB:GI61btWz9puQWB

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      8bf20bfc18d0eccfafa105cb9c0ab826_JaffaCakes118

    • Size

      511KB

    • MD5

      8bf20bfc18d0eccfafa105cb9c0ab826

    • SHA1

      9aff38f20566374adae457bf76822ebac88f1dd2

    • SHA256

      323fff89eace9d8c40d8f66893e617309ee21f2ab75cfae5f5b3cc795d4110e7

    • SHA512

      a0539fa07789875d4c2afc31e7d83c317d0c3d32de79c73647e17376bf664cba425975df97640fbe722566284b9371da29e8d6998eb97f93e1a1253b9d7f56e2

    • SSDEEP

      12288:o3W85Eau61btezvs6VT4wl5TMnAjqhyrDLWPzB:GI61btWz9puQWB

    Score
    10/10
    discoveryevasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks